fix: critical bug fixes, security hardening, and iOS Voxlen account key support #4746

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/voxlen/pull/55

Summary

• Critical Rust compile fix: Removed duplicate translate_with_voxlen_proxy() function and dead code block calling undefined fetch_proxy_deepgram_key — both would have caused build failures
• Standardized all Voxlen proxy URLs to voxlen.ai/api/* (was inconsistently mixing api.voxlen.com/v1/*)
• iOS keyboard: Added mip_opt_out=true to Deepgram WebSocket URL; added Voxlen account key support (token exchange flow) so iOS users don't need a separate Deepgram key; added Voxlen account key field to companion settings app
• API security: Added 50k char limit on grammar/translate endpoints and 25 MB limit on STT audio upload to prevent cost abuse
• Data integrity: clauses.ts markUsed() now persists recently-used order across restarts; clients.ts addEntry() silently drops entries with unknown clientIds
• Dashboard: ConnectDesktopApp shows error on key generation failure instead of hanging; fixed async forEach memory leak in OverviewTab ping loop → Promise.all + AbortController
• Plan display: free_trial now shows as "Free Trial" in settings instead of "Free_trial"
• TypeScript fixes: TS6133 unused state, TS2741 missing prop, TS2345 in SDK test

Test plan

• All 172 unit tests pass (npx vitest run)
• TypeScript clean (npx tsc --noEmit)
• Vercel preview deployed green
• Rust: no duplicate function errors (cargo check)
• iOS keyboard: Voxlen account key field visible in companion app; token exchange triggers when voxlenApiKey set and deepgramApiKey empty

https://claude.ai/code/session_011MFNHeFKrhfuSrEYVgrdyr