Add DOCX audiobook planning, OpenRouter chunks, and mastering

[JOTAAAA12]

Summary

• Completes the DOCX audiobook vertical slice: local DOCX chunking, explicit OpenRouter structured chunk flow, result merge, resumable generation checkpoints, FFmpeg mastering, and QC reporting.
• Adds redacted-by-default operator outputs for preview/next, keeps OpenRouter behind explicit consent and env-only credentials, and removes provider imports from offline entrypoints.
• Adds no-overwrite FFmpeg behavior, source/output collision guards, QC CLI, workflow CLI, structured result contract validation, local artifact ignore rules, and SpecOps release governance.
• Adds a multiagent-planned and partially implemented frontend-project-workspace: SQLite workspace vault, session/env-only provider metadata, token/cost simulator, safe backup/restore, CLI, and dedicated Gradio API & Costs page.

Validation

• py -3 -B -m pytest -p no:cacheprovider -q -> 53 passed, 1 skipped
• py -3 -B -m compileall -q omnivoice\audiobook omnivoice\narration -> passed
• Strict secret scan for OpenRouter key prefixes, env assignments, and bearer-key patterns -> passed
• Offline provider boundary scan over offline/workspace entrypoints -> passed
• git diff --cached --check before commits -> passed
• Workspace CLI smoke: init DB, create project, estimate cost -> passed
• FFmpeg local smoke with synthetic WAVs -> master generated, ffprobe duration 0.300000

SpecOps Seal

• specops validate through the Core Business LittleBull AI wrapper -> SpecOps validation passed with 0 issues.
• specops eval after workspace implementation -> 16 passed, 0 failed
• specops report -> generated locally; timestamped reports were not committed.

Workspace Vault Implementation

• Added SQLite schema/repository for projects, documents, chunks, plans, provider runs, token usage, costs, audio assets, QC, checkpoints, backups, settings, and secret metadata.
• Added session-only and environment-driven secret-store boundary. SQLite stores only non-secret provider metadata.
• Added token/cost estimator with estimated-vs-actual separation.
• Added safe backup export/import with manifest, hashes, default DOCX exclusion, secret-pattern rejection, and restore path validation.
• Added omnivoice-audiobook-workspace CLI and omnivoice-audiobook-workspace-ui Gradio page.

Notes

• No live OpenRouter call was run because OPENROUTER_API_KEY is not present in this environment. Live provider smoke remains approval-gated and must use only a short public-domain fixture.
• Durable persisted API key storage intentionally remains unimplemented until a real OS keyring adapter is selected. Current safe modes are environment or session-only.
• No private manuscripts or generated audiobook files are committed.