fix(voice): move preset audio to Azure Blob

[luke-n-alpha]

Closes #392

Summary

• move the default public CC0 reference-audio URL from GCS to the dedicated Azure Blob account
• replace the exact Tauri media CSP origin without widening policy
• preserve the existing private uploaded-audio gateway path
• add FR-VOICE.8 traceability and a packaged-CSP contract test

Verification

• focused shell tests: 81/81 passed
• Azure CSP contract: 1/1 passed
• root TypeScript build passed
• shell production build passed
• Azure object probe: HTTP 200, Content-Length 193550, RIFF/WAVE
• adversarial review: two consecutive CLEAN rounds

Known unrelated baseline

• full root test has four pre-existing paired-agent pin failures (expected e44b0f..., current main 5c496c...)
• root structure check reports pre-existing unregistered tsconfig.build.json