fix(audio-cpp): refuse a task pin the RPC cannot serve, and stop empty frames holding the lane

The model's `task:` option is copied into the request shape by all nine
handlers, which is correct, but resolve_route then replaced the RPC's candidate
list with the pin WHOLESALE and never asked whether the pin was something that
RPC routes to. One pin therefore bled across all nine surfaces, and because the
family still supported the pinned task the result was a wrong 200 rather than an
error. Reproduced live: nemotron with task:asr made Vad return 200 with zero
segments after a full ASR decode, so 14 seconds of speech was reported as
silence, and Diarize did the same; silero_vad with task:vad made
AudioTranscription return 200 with empty text and four segments whose spans were
VAD segments, which combined with response_format in {text,srt,vtt,lrc} building
the body solely from Segments[].Text yields a well formed SRT of four timed
EMPTY cues. It also contradicted the documented contract, that a family which
cannot serve a request is refused rather than rerouted.

A pin is now checked against the RPC's admissible task set before it is adopted,
and the refusal names both the pin and the RPC. The set is derived from
task_candidates with every shape flag set rather than restated, so a task added
to an RPC's candidates cannot become inadmissible by omission. Every legitimate
pin survives, and the test asserts all fifteen of them alongside the eight
crossings that must not.

The live watchdog was defeated by empty frames. idle.touch() ran on ANY message,
before the has_audio and pcm.empty() filters, so a peer writing unset-oneof or
zero-length frames faster than the window held the lane indefinitely while
feeding the decoder nothing. There is one lane per model and one model per
process, so that is a single client denying the whole backend, which is what the
watchdog exists to prevent, and the thrown text already said "no audio frame
arrived". The touch moved below the filters, which are now a named predicate so
the distinction is testable rather than a call order nobody can see.

Three comments corrected against measurement rather than reasoning:

- CMakeLists claimed zero google::protobuf:: definitions remain in the
  executable. nm -C --defined-only reports 2515, and that is expected: they are
  generated code, sentencepiece::ModelProto's own _InternalParse among them. The
  claim that holds, and the one the ABI fix is actually about, is that no
  vendored protobuf RUNTIME is linked and ParseContext::ParseMessage is
  UNDEFINED in the executable, resolving to libprotobuf.so.
- refuse_cloning_without_a_clip's "cannot misfire" paragraph had its reasoning
  backwards. Routing picks VoiceCloning as the FALLBACK when there is no clip,
  which is the case being caught; chatterbox, which ships in the gallery,
  advertises clon and no tts at all, so every voice-less request lands there.
- audio_units read "2.1 min at 96 kHz" for index 11289602, which is 1.96 min.
  2.1 min is 96 kHz's OWN first failure at 12288002. Both were remeasured and
  the note is now a per-rate table.

Assisted-by: Claude:claude-opus-5 [Claude Code]
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

backend/cpp/audio-cpp/grpc-server.cpp

@@ -496,10 +496,17 @@ float audio_duration_seconds(const engine::runtime::AudioBuffer &audio) {
 // chatterbox advertises clon and no tts at all, so before this every preset-only
 // or voice-less request to it got that engine-internal message.
 //
-// It cannot misfire on the legitimate case: has_voice_reference is what made
-// routing choose VoiceCloning in the first place, so reaching here with a clip
-// present is impossible unless the model pinned task:clon, and a clon pin with
-// no clip is exactly the misconfiguration worth naming.
+// The case it catches is the FALLBACK one, which is worth stating the right way
+// round. A clip is what makes routing put VoiceCloning first, but VoiceCloning
+// is also the last candidate a clip-less TTS request falls back to
+// (task_candidates returns {Tts, VoiceCloning, VoiceDesign} when no clip and no
+// instructions are supplied), so a family that advertises clon and no tts at
+// all - chatterbox, which is what ships in the gallery - routes EVERY voice-less
+// request here. A task:clon pin arrives here the same way.
+//
+// It cannot misfire on the legitimate case for the opposite reason: a request
+// that did supply a clip has voice_is_file set and returns on the line above
+// before anything is thrown.
 //
 // Deliberately NOT generalised to "every task whose family declares
 // supports_speaker_reference". That flag lives on the engine's CapabilitySet, is
@@ -1827,7 +1834,6 @@ public:
             std::int64_t consumed_frames = 0;
             const auto next_frames = [&](std::vector<float> &out) {
                 while (stream->Read(&incoming)) {
-                    idle.touch();
                     if (incoming.has_config()) {
                         // backend.proto says a second Config resets the decode
                         // session. audio.cpp cannot do that truthfully: a reset
@@ -1844,15 +1850,20 @@ public:
                             "' cannot reset a live session mid-stream; close "
                             "this stream and open a new one");
                     }
-                    if (!incoming.has_audio()) {
-                        // Neither arm of the oneof is set. Nothing to feed, and
-                        // not worth failing a live session over.
-                        continue;
-                    }
+                    // Touched only for a frame the decoder can actually consume,
+                    // and touched AFTER the filters rather than before them.
+                    // Neither arm of the oneof set, or an empty pcm field, is
+                    // nothing to feed and not worth failing a live session over
+                    // - but it is also not the peer proving it is still there,
+                    // and resetting the window for it let one client hold the
+                    // model's only lane indefinitely by writing empty frames
+                    // faster than the window. See live_frame_carries_audio.
                     const auto &pcm = incoming.audio().pcm();
-                    if (pcm.empty()) {
+                    if (!audiocpp_backend::live_frame_carries_audio(
+                            incoming.has_audio(), pcm.empty())) {
                         continue;
                     }
+                    idle.touch();
                     out.assign(pcm.begin(), pcm.end());
                     // Mono, so floats and frames are the same count. Only used
                     // for the duration reported in final_result.