feat(ui): load recording from waaudio://; remove download affordance

src/lib/views/SummaryPanel.svelte

@@ -1,7 +1,6 @@
 <script lang="ts">
   // Right pane: LLM summary, action items, participants (Phase 5/6, FR-LLM-*/FR-CAL-*).
   import { onMount } from "svelte";
-  import { convertFileSrc } from "@tauri-apps/api/core";
   import { meetings } from "../stores/meetings.svelte";
   import { calendar } from "../stores/calendar.svelte";
   import { settings } from "../stores/settings.svelte";
@@ -38,8 +37,8 @@
       const id = m.id;
       api
         .recordingPlaybackPath(id)
-        .then((p) => {
-          if (meetings.selected?.id === id) audioSrc = convertFileSrc(p);
+        .then((url) => {
+          if (meetings.selected?.id === id) audioSrc = url;
         })
         .catch((e) => {
           if (meetings.selected?.id === id) audioError = errorMessage(e);
@@ -258,7 +257,15 @@
     <h3><Mic2 size={14} aria-hidden="true" /> Recording</h3>
     {#if audioSrc}
       <!-- svelte-ignore a11y_media_has_caption -- a meeting recording has no caption track -->
-      <audio class="player" controls src={audioSrc}></audio>
+      <!-- controlsList/contextmenu: no download affordance — the decrypted audio
+           must not be savable to disk (would undermine encryption at rest). -->
+      <audio
+        class="player"
+        controls
+        controlsList="nodownload noplaybackrate"
+        oncontextmenu={(e) => e.preventDefault()}
+        src={audioSrc}
+      ></audio>
     {:else if audioError}
       <p class="muted">{audioError}</p>
     {:else}