fix: enable same-origin voice capture (Closes #933)

tests/test_security_headers.py

@@ -14,7 +14,10 @@ REQUIRED_HEADERS = {
 def assert_browser_security_boundary(response: httpx.Response) -> None:
     for name, value in REQUIRED_HEADERS.items():
         assert response.headers[name] == value
-    assert "camera=()" in response.headers["permissions-policy"]
+    permissions_policy = response.headers["permissions-policy"]
+    assert "camera=()" in permissions_policy
+    assert "microphone=(self)" in permissions_policy
+    assert "microphone=()" not in permissions_policy
     policy = response.headers["content-security-policy"]
     assert "default-src 'self'" in policy
     assert "script-src 'self'" in policy

tests/test_voice_issue_capture.py

@@ -296,6 +296,43 @@ process.stdout.write(JSON.stringify({{
     }
 
 
+def test_recognition_start_rejection_restores_controls_and_preserves_draft():
+    script = f"""
+const {{createVoiceIssueCapture}} = require({json.dumps(str(VOICE_CAPTURE))});
+class Element {{
+  constructor() {{ this.hidden=false; this.value=''; this.textContent=''; this.listeners={{}}; }}
+  addEventListener(name, callback) {{ this.listeners[name]=callback; }}
+  click() {{ this.listeners.click?.({{currentTarget:this}}); }} dispatchEvent() {{}}
+}}
+class Recognition {{
+  start() {{ throw new Error('microphone blocked by browser policy'); }}
+  stop() {{}} abort() {{}}
+}}
+const elements=Object.fromEntries(
+  ['root','start','stop','review','transcript','append','replace','status','title','body'].map(key=>[key,new Element()])
+);
+elements.title.value='Existing title';
+elements.body.value='Existing note';
+elements.transcript.value='Recovered transcript.';
+elements.start.hidden=false; elements.stop.hidden=true;
+createVoiceIssueCapture({{Recognition,elements}});
+elements.start.click();
+process.stdout.write(JSON.stringify({{
+  startHidden:elements.start.hidden, stopHidden:elements.stop.hidden,
+  status:elements.status.textContent, title:elements.title.value,
+  body:elements.body.value, transcript:elements.transcript.value
+}}));
+"""
+    assert run_node(script) == {
+        "startHidden": False,
+        "stopHidden": True,
+        "status": "Voice capture could not start. Your draft and transcript are unchanged.",
+        "title": "Existing title",
+        "body": "Existing note",
+        "transcript": "Recovered transcript.",
+    }
+
+
 def test_stop_error_and_sheet_close_release_recognition_without_losing_transcript():
     script = f"""
 const {{createVoiceIssueCapture}} = require({json.dumps(str(VOICE_CAPTURE))});