fix: dictation cloud path — bearer subprotocol, access_token grant field

Two live-verified Deepgram facts from the first real mic-test round:
- /v1/auth/grant returns { access_token }, not { token } — the route now
  parses the right field.
- Minted JWTs authenticate over the WebSocket via the "bearer"
  subprotocol; ["token", jwt] is rejected at the handshake (token is
  for raw API keys only, as in the pi dictate extension).

Also documents the env-precedence gotcha in docs/research/stt.md: a
DEEPGRAM_API_KEY exported in the shell (e.g. .zshrc) silently beats
.env.local in next dev and the desktop authEnv() seam.

app/api/stt/token/route.ts

@@ -35,11 +35,11 @@ export async function GET() {
 				{ status: 502 },
 			);
 		}
-		const data = (await res.json()) as { token?: string };
-		if (!data.token) {
+		const data = (await res.json()) as { access_token?: string };
+		if (!data.access_token) {
 			return Response.json({ message: "Deepgram grant returned no token" }, { status: 502 });
 		}
-		return Response.json({ token: data.token });
+		return Response.json({ token: data.access_token });
 	} catch {
 		return Response.json({ message: "Deepgram unreachable" }, { status: 502 });
 	}