Add clean and highlighted-subtitle video export

[nickbeau]

Summary

• add clean vs highlighted-subtitle export choices to Studio review
• capture speech-confirmed script word timings locally and preview a one-line lower third during playback
• let presenters choose from six Windows-safe subtitle fonts and persist the export preference
• render deterministic ASS captions with active-word color/scale emphasis through bundled FFmpeg
• validate the binary video/caption envelope and preserve the clean take when rendering fails
• make bundled FFmpeg resolution work in Windows ARM64/x64 and packaged app.asar layouts
• update the transitive nanoid lock entry to 3.3.18 after CI identified GHSA-2v37-7h3g-55p8

Validation

• npm.cmd audit --audit-level=high: passed, zero vulnerabilities
• npm.cmd test: passed, 55 tests across 11 files
• npm.cmd run typecheck: passed
• npm.cmd run build: passed
• npm.cmd run build:desktop: passed (client and bundled local server)
• synthetic H.264/AAC take through POST /api/recordings/subtitles: returned a valid MP4 that decoded cleanly; inspected frame confirmed Georgia rendering, lower-third placement, full-line display, and active-word highlighting
• git diff --cached --check: passed before commit
• GitHub Actions validate: passed

Notes

• Subtitle export intentionally re-encodes video and briefly uses additional local CPU, memory, and temporary disk. Inputs are removed after the response; no media or transcript leaves loopback.
• Clean native MP4 remains a direct download. The clean/raw take remains available after any subtitle-render failure.
• npm.cmd run speech:smoke and npm.cmd run speech:smoke:arm64 cannot start on this Windows ARM64 development host because their unchanged bootstrap requires a sherpa-onnx-win-arm64 native addon that the project does not install. The failure occurs before this change's code loads; the feature's speech-timing logic is covered by focused unit tests.