Merge remote-tracking branch 'upstream/main' into core-rb2

# Conflicts:
#	CHANGELOG.md
#	build/vite.js
#	scripts/package-boundaries.json
#	server/standalone/vite.config.js
#	src/app/scene.js
#	src/layers/vessels/queries.js
#	src/standalone/application.js
#	src/tooling/viteBuild.test.mjs
#	src/ui/cockpitInstruments.js
#	src/ui/layerPanel.js
#	src/ui/panelPositionControls.js

src/voice/realtimeConnection.js

@@ -84,6 +84,7 @@ export class RealtimeConnection {
     this.debugLog('session.starting', {
       epoch,
       tier: this.cost.voiceTier,
+      authMode: this.cost.sessionCloudVoiceAuth,
       connection: this.connectionDiagnostics(),
     });
     let localStream = null;
@@ -91,6 +92,7 @@ export class RealtimeConnection {
     try {
       const minted = await this.backend.requestToken({
         tier: this.cost.voiceTier,
+        authMode: this.cost.sessionCloudVoiceAuth,
         signal,
       });
       const token = minted.token;
@@ -100,6 +102,7 @@ export class RealtimeConnection {
       // and pricing by the tier we asked for would then under-meter and let the
       // cap be overrun. Unrecognised ids bill at worst-case rates.
       const costState = this.cost.bindServedModel(minted.model);
+      this.cost.bindTranscriptionModel?.(minted.transcribeModel);
       if (!costState.ratesRecognized) {
         console.warn(
           `[GEV voice] unrecognised Realtime model "${costState.modelId}" — ` +