fix: Opus review pass — harden before building

- Widen voice ID validation to 20-64 alphanumeric (future-proof)
- Remove hardcoded default voiceId (SJ personal clone)
- Require voiceId in isConfigured + synthesize guard with clear error
- Add model header comment explaining Fish Audio's non-standard API
- Truncate error bodies to 500 chars to prevent log pollution
- Update tests and README to match

tts.ts

@@ -70,6 +70,9 @@ export async function fishAudioTTS(params: {
       body.top_p = topP;
     }
 
+    // Fish Audio uses the `model` HTTP header (not a body field) to select
+    // the TTS model. This is intentional per their API spec — don't move it
+    // into the JSON body.
     const response = await fetch(url, {
       method: "POST",
       headers: {
@@ -85,7 +88,10 @@ export async function fishAudioTTS(params: {
       let errorDetail = "";
       try {
         const errorBody = await response.text();
-        errorDetail = errorBody ? `: ${errorBody}` : "";
+        // Cap at 500 chars to avoid log pollution from large error responses
+        const truncated =
+          errorBody.length > 500 ? `${errorBody.slice(0, 500)}…` : errorBody;
+        errorDetail = truncated ? `: ${truncated}` : "";
       } catch {
         // Ignore error body read failure
       }