Integrate runtime settings across setup, webserver, and bot

[Dadud]

Summary

This PR makes the setup/settings console control real runtime behavior across the webserver and bot:

• resolves SQLite settings before .env before defaults for runtime config
• decrypts write-only SQLite secrets before falling back to .env
• updates webserver geocoding, AI categorization, audio serving, and diagnostics to use runtime settings
• updates bot.js AI summary/Ask AI, public audio URLs, transcription providers, and storage paths to use runtime settings
• adds runtime transcription settings for local, remote Faster Whisper, OpenAI, and iCAD modes
• adds runtime S3/local storage settings and write-only S3 credential handling
• expands setup/settings UI coverage for transcription and S3 provider fields
• hardens setup completion so required readiness checks must pass before marking setup complete
• adds tests for settings precedence, secret redaction/decryption, setup status, and provider readiness checks

Verification

• npm test
• npm run check:syntax
• npm run check:config

Notes

This keeps the existing map UI intact and focuses on making setup/settings additive and operational. Some settings are still marked restart-required where hot-swapping could be risky for long-running processes.