feat: configure audio providers and add local sample acceptance

server/.env.followup-audio.example

@@ -1,5 +1,5 @@
 # Merge this section into the target environment's existing .env. No credentials are provided here.
-# Existing [prescription_ai] configuration is reused, not replaced.
+# Only dify may reuse existing [prescription_ai] base/key. MODEL is required only for openai_audio.
 [followup_audio]
 ENABLED = false
 AUDIO_VERIFIED = false
@@ -14,3 +14,22 @@ FFPROBE = ffprobe
 # At least 32 characters; keep secret, stable, backed up and identical on web/worker nodes.
 # Empty uses the existing prescription_analysis key; never rotate without a data re-encryption plan.
 ENCRYPTION_KEY =
+
+# Never enable HTTP for real audio. This switch applies only to the synthetic CLI probe.
+ALLOW_INSECURE_SYNTHETIC = false
+# Supported drivers: dify, openai_audio. openai_audio MODEL is sent in the request.
+# Dify selects an application with its key; MODEL does not change the model inside that app.
+QWEN_DRIVER = dify
+QWEN_BASE_URL =
+QWEN_API_KEY =
+QWEN_MODEL =
+QWEN_LABEL = qwen
+QWEN_VERIFIED_FINGERPRINT =
+OPENAI_DRIVER = dify
+OPENAI_BASE_URL =
+OPENAI_API_KEY =
+OPENAI_MODEL =
+OPENAI_LABEL = openai
+OPENAI_VERIFIED_FINGERPRINT =
+# Fingerprints must come from all three passing synthetic gates for this exact driver/URL/model/key.
+# Any identity change invalidates prior verification; unknown prior requests still require reconciliation.