Closes #2175

Summary

• Add stt_model: Option<String> to ProviderEntry, following the existing embedding_model/vision_model flat-union pattern
• Slim SttConfig: remove model and base_url (moved to provider entry); keep provider (name ref) and language
• Add stt_provider_entry() and validate_stt() resolution helpers on LlmConfig
• Replace string-based candle detection with type-safe ProviderKind::Candle + stt_model check
• Add migrate_stt_to_provider() as step 1 of the --migrate-config pipeline
• Remove deprecated env vars ZEPH_STT_MODEL and ZEPH_STT_BASE_URL
• Add MigrateError::InvalidStructure for proper error propagation (replaces .expect() panics)
• 22 new unit tests across providers.rs and migrate.rs

Breaking Change

Configs with [llm.stt] model = ... or [llm.stt] base_url = ... must be migrated:

cargo run --features full -- --migrate-config path/to/config.toml

Config before/after

Before:

[llm.stt]
model = "gpt-4o-mini-transcribe"
base_url = "https://api.openai.com/v1"
provider = "openai"
language = "auto"

After:

[[llm.providers]]
name = "whisper"
type = "openai"
model = "gpt-4o-mini-transcribe"
stt_model = "gpt-4o-mini-transcribe"

[llm.stt]
provider = "whisper"
language = "auto"

Test plan

• cargo +nightly fmt --check — clean
• cargo clippy --profile ci --workspace --features full -- -D warnings — 0 warnings
• cargo nextest run --workspace --features full --lib --bins — 6488 passed (+32 vs base)
• Security audit: no secrets leaked in logs or migration output
• Adversarial implementation review: all 6 pre-implementation warnings addressed