Stop /api/transcribe from leaking SSRF and config details

[groupthinking]

Fix /api/transcribe error branches so caller-visible messages don’t reveal audioUrl probe status, provider key state, or SSRF guard reasons.

[linear-code]

GRV-358

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[groupthinking]

Closed as completed by #1440 (via #1381 stack, merged 2026-08-07). Acceptance criteria match: probe status, provider key state, and SSRF guard reasons are no longer returned to callers from /api/transcribe / fetchTranscript. Residual coarse SSRF admit/deny signal is documented as accepted in the route docblock.