Prove spoken-language transcription end to end; fix CORS for X-Request-ID

[Chaddacus]

Why

A user reported Spanish audio transcribed as English. Grounding on production showed the report predates the Deepgram cutover (#38, deployed 2026-06-29) and the current auto path already keeps the spoken language. This PR adds the proof and hardening instead of a provider change, and fixes a CORS defect found while proving it.

What

• Decision record: docs/adr/004-language-detection-strategy.md — keep detect_language=true; language=multi rejected (wrecks ko/zh, probe table inside).
• Fixtures: backend/tests/fixtures/audio/ — es-MX, es-ES, en-US, ko, zh, mixed en→es (348 KB total, synthetic voices).
• Unit tests: tests/test_language_detection.py (16 tests, recorded provider shapes).
• Live provider tests: tests/live/ — pytest -m live, excluded from the default run.
• Browser proof: frontend/e2e/tests/multilingual-upload.spec.js — real upload → real Deepgram → Spanish text + Spanish badge. Opt-in with CLIO_LIVE_E2E=1.
• UI: language badge shows the language name ("Spanish") with a lang attribute and data-testid="note-language".
• CORS fix: x-request-id added to CORS_ALLOW_HEADERS + tests/test_cors_preflight.py. The browser dropped POST /api/notes/ after preflight on any cross-origin deployment (dev stack, CI e2e). Production is same-origin and unaffected.

Evidence

• pytest: 139 passed, 6 live deselected. pytest -m live: 6 passed against real Deepgram.
• ruff check: clean. tsc --noEmit: clean. npm run lint: 0 errors (12 pre-existing warnings).
• Playwright multilingual-upload.spec.js: 2/2 passed against the dev stack; screenshots inspected (Spanish badge, untranslated Spanish text; mixed clip keeps both languages).
• Full existing Playwright suite: 49 passed, 4 failed. The 4 are pre-existing and unrelated: health and registration pass when run alone (failures were 429 throttling under the parallel run); comprehensive-harness and production-sweep look for an h1 "Record Voice Note" that the page no longer has ("New Voice Note").

Not in scope

• Translation ("translate to this language") is a separate AI capability with its own contract and evals.
• production-sweep.spec.js runs against production and registers users there; flagged, not changed.

Acceptance mapping

Owner-confirmed acceptance, three clauses, and where each is pinned:

1. "A Spanish recording comes back as Spanish text" — tests/live/test_deepgram_live.py (es-MX, es-ES) and the Playwright Spanish case.
2. "A recording that switches between English and Spanish keeps each part in its own language" — test_mixed_english_spanish_keeps_both_languages (live) and the Playwright mixed case.
3. "The original transcript is never replaced" — test_spanish_text_is_kept_not_translated (unit) and the Playwright assertion that the Spanish note does not contain the English rendering. The explicit, user-invoked Re-transcribe action does overwrite the transcript by design; that path is unchanged here and stays covered by the pre-existing test_retranscribe_task_happy_path.

Review

Fresh-context adversarial review: approve with minors. Both addressed in the follow-up commit: the badge no longer carries a lang attribute (its label is English), the detected code is exposed as data-language instead; this section adds the acceptance mapping.