Route all remaining agent/API audioUrl emits through the cached host

[uncleJim21]

Why

Follow-up to #133. That PR rewrote audioUrl → the Cloudflare-cached host
(audio.pullthatupjamie.ai) at the three main playback formatters. But several
other agent/API-facing endpoints still returned the raw DigitalOcean host, and one
doc showed a raw-host audioUrl example — so agents hitting those surfaces (or
copying the doc) would still bypass the cache and bill DO egress.

Changes

Wrap publicAudioUrl() at every remaining agent/API audioUrl emit site so
"just use audioUrl" is always the cached host. The helper is idempotent
(no-ops on already-rewritten URLs, on podcaster-hosted RSS URLs, and on
null/sentinels), so double-wrapping downstream of #133's formatters is safe.

• routes/jamieExploreRoutes.js — 3D-search / hierarchy API (×2)
• routes/researchSessions.js — research-session clips
• services/tape/tapeShared.js — tape results
• utils/workflowSteps.js (×2) + utils/workflowOutputFormatter.js — agent workflow output
• agent-tools/neo4jTools.js — graph tool
• utils/entitlementMiddleware.js — Mongo-mirror clip DTO

Docs / skill:

• docs/details-apis/HIERARCHY_API.md — the two audioUrl examples now show
  audio.pullthatupjamie.ai instead of the raw cascdr-… host.
• skills/.../podcast-rra.md — note on the audioUrl field: use it verbatim;
  do not construct audio URLs from feedId/guid or hardcode a CDN host.

Deliberately left as-is

• llms.txt + openapi.json — already clean (llms.txt points agents at
  /api/search-quotes → the audioUrl field and shows no raw host; openapi's
  audioUrl is a bare format: uri). Note: llms.txt is served from the
  frontend repo, not here.
• docs/EXTERNAL_VIDEO_PARENT_ID.md cascdr refs — those document the
  video-edit CDN allowlist, not audio playback; changing them would be wrong.
• RSS-origin emits (LandingPageService, PodcastRssCacheManager) — those set
  audioUrl from the podcaster's own enclosure (itemUrl), not our bucket, so
  there's nothing to rewrite (and the helper would no-op anyway).

Tests

• node --check clean on all 7 changed source files.
• Verified (grep) that no agent-facing audioUrl emit remains unwrapped
  (only schema defs, "URL unavailable" sentinels, and RSS itemUrl remain, as
  intended).
• publicAudioUrl unit behavior + live Worker serving were proven in Serve audio playback through the Cloudflare-cached host (audio.pullthatupjamie.ai) #133.

🤖 Generated with Claude Code