feat(frontend): hand a Tavus conversation over at its ceiling

[micio86dev]

What

FE-06 of tavus-single-session-interview: the ceiling handover. Three commits.

1. chore: sync openapi.json and the generated types with the merged api contract (conversation_ttl_seconds only; generated with bun run codegen).
2. 06a: the crossfade predicate becomes "a fresh handle arrives while a live handle exists" (the HeyGen-only gate is removed, so a Tavus fresh handle crossfades and arms the 10 s bound on publish); an age timer from conversation_ttl_seconds minus HANDOVER_LEAD_MS (120 s) calls /start on the in_corso row to obtain the fresh handle with the question clock preserved. The timer is armed only for Tavus handles with a positive lead, re-armed per fresh handle, cleared on teardown/pause/clearActiveProvider, and skips when the handle is no longer live or a boundary/handover is in flight. It does not mute the outgoing microphone (the candidate is mid-answer).
3. 06b: the Tavus provider emits stopped once on a left-meeting it did not cause (the client recognises its own stops through a WeakSet filled by the idempotent stop wrapper); the client resumes the in_corso row via /start, but not for a deliberate stop or after the final competency.

Decisions

• At a boundary, a fresh /start response now publishes the new handle as incoming and keeps the joined one live (before: stop it and show connecting). The old FE-04 test asserting that was changed accordingly.
• ProviderSession.playerKey equals dbSessionId except for a replacement on the same row (a handover keeps the session_id), where it takes a negative serial; players and notifyPainted use it. tests/unit/arch/attribution-cursor-arch.spec.ts now expects zero x.dbSessionId reads.
• HeyGen handover suites (interview-handover.spec.ts, use-interview-session.spec.ts) are byte-identical to develop.

Verification

RED first (5 of 13 ceiling tests failed before; the provider-ended spec failed before). Mutations (restore the HeyGen-only gate, drop the lead subtraction, treat a deliberate stop as unannounced) each fail tests and were reverted. Full Vitest 119 files / 2996 tests, 96.26% lines (CI threshold 85); typecheck and lint pass. Not verified: real Daily/Tavus, Playwright (FE-07), and a closing phrase or question-timer tick arriving mid-handover (the existing guards ignore it; untested).