fix: codebase scan — duplicate import, prompt injection, grammar safety, BYOK onboarding #4742

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/voxlen/pull/59

Summary

Codebase scan — 7 bug fixes across desktop app, Rust backend, iOS keyboard, Vercel API, and Web SDK.

• OnboardingWizard (src/components/onboarding/): canProceed() step 2 only checked voxlenApiKey, blocking BYOK users from completing onboarding. Now accepts sttApiKey as well.
• DictationPanel (src/components/dictation/): Removed duplicate useShallow import causing TS2300 compile error.
• Prompt injection hardening (all AI call sites): User text was interpolated directly into format strings in translate.ts (Vercel), grammar.ts (Vercel), grammar.rs (Rust), translate.rs (Rust), grammar.ts (Web SDK), and KeyboardViewController.swift (iOS). Fixed with XML delimiter tags (<text>...</text>) in all six locations.
• grammar.ts (SDK): Added try/catch around both JSON.parse calls (Claude + OpenAI paths) so malformed model responses return a graceful fallback instead of throwing.
• iOS keyboard (ios/VoxKeyboard/): correctGrammar() read "apiKey" and "aiProvider" from UserDefaults but the companion app stores them as "grammarApiKey" / "voxlenApiKey" / "grammarProvider" — grammar correction always failed with noApiKey. Added Voxlen proxy path (preferred) and fixed all UserDefaults key names.
• generate-key.ts (Vercel): Admin-issued keys for other users embedded the admin's Google sub in the minted JWT. Changed to use an email-derived sub for cross-user issuance.
• SRT export (src/lib/export.ts): formatAsSrt used wall-clock Date.getHours() / .getMinutes() / .getSeconds() for SRT timestamps, so exported files started at e.g. 22:30:25,000 instead of 00:00:00,000. Fixed to compute millisecond offsets from the first segment's timestamp.
• Settings persistence data loss (src/lib/settings.ts, src-tauri/src/commands/settings.rs): update_settings called persist_settings which re-serialized only Rust-known fields — billableRatePerHour, legalAcceptedVersion, and legalAcceptedAt were silently dropped on every settings save. Added these as round-trip fields to Rust AppSettings (with #[serde(default)]) and to BackendAppSettings / toBackendSettings / fromBackendSettings in the TS settings lib.

Test plan

• TypeScript compiles clean (npx tsc --noEmit — 0 errors)
• All 178 tests pass
• All 4 Vercel deployments succeeded (Ready)
• BYOK user can advance past step 2 of onboarding with only a Deepgram key set
• SRT export starts at 00:00:00,000 for first segment
• Settings changes survive an app restart (billableRatePerHour, legalAcceptedAt not wiped)
• iOS grammar correction works with Voxlen account key (proxy path) and with direct grammarApiKey