Add end-to-end encrypted voice messages; release v5.4.5

- Record voice notes in-browser, sent over the chunked AES-GCM file-transfer
  channel (per-file session key + signed SHA-256 integrity).
- Captured as PCM and encoded to WAV for universal playback (incl. iOS/Safari);
  auto-accepted and played inline from an in-memory blob, never written to disk.
- Composer mic button with live waveform + timer; desktop shows mic + send side
  by side, mobile swaps mic to send when typing.
- CSP media-src now allows blob: so recorded/received audio can play.
- Roadmap: Desktop Edition -> 5.0, new 5.5 'Secure Voice & Calls', later
  milestones shifted; version bumped to 5.4.5.
- Update README, docs (security/API/cryptography), and CHANGELOG.

doc/API.md

@@ -18,6 +18,16 @@
 - `setFileTransferCallbacks(onProgress, onReceived, onError, onIncomingRequest)` updates manager fields and any live `EnhancedSecureFileTransfer` instance.
 - Passing `null` values detaches callbacks from the active transfer system.
 
+### Voice messages
+
+- `sendFile(file, options)` accepts an optional `options` object. `options.voice`
+  (`{ dur, bars }`) marks the transfer as a voice note and rides along as unsigned
+  metadata; `options.uiId` correlates progress events to a UI bubble before the
+  `fileId` resolves.
+- `onProgress` receives `{ fileId, uiId, direction, progress, isVoice, voice }`.
+  `onIncomingFileRequest` and `onReceived` include `isVoice` and `voice` so the UI
+  can auto-accept and render a voice bubble instead of a file card.
+
 ## EnhancedSecureFileTransfer
 
 ### Incoming transfers