feat: add xAI provider support

[Julientalbot]

Summary

• add xAI as a selectable agent provider using the OpenAI-compatible Chat Completions API for tool-calling compatibility
• add xAI streaming STT support, including language selection, staging vocabulary keyterms, and a configurable smart-turn timeout
• add a Latency status-panel editor for xAI STT timeout plus transcript-to-agent debounce/max-wait timing
• persist/sanitize xAI and latency settings and add pricing/tests/docs coverage
• force the initial xAI whiteboard turn to call `whiteboard_apply` when the live canvas is empty and the transcript is substantive
• reduce perceived transcript-to-whiteboard latency by lowering xAI STT end-of-turn timeout and coalescing tiny incomplete transcript fragments before agent calls
• let Stop drain the final transcript/agent turn before ending the live session, while clearing pending transcript buffers when sessions end
• preserve live whiteboard updates that arrive before Excalidraw is ready, and prevent an empty client mount from echoing `whiteboard:user-elements: []` back to the server
• make the browser smoke test use an isolated Chrome debug port and navigate explicitly before assertions

Validation

• `npm run typecheck`
• `npm test` (261 tests)
• in-app browser smoke: opened the Latency row and confirmed STT timeout, Debounce, and Max wait number fields
• direct xAI tool-calling smoke executed a tool and finished cleanly
• direct xAI agent smoke with the reported French topics created whiteboard elements instead of returning only `DONE`
• manual xAI STT websocket smoke reached ready state
• manual synthetic French audio smoke produced committed French transcripts
• end-to-end local smoke: synthetic French audio -> xAI STT -> xAI agent -> `whiteboard:update` with visual elements
• local browser reload smoke: existing live server scene stays non-empty and renders after the frontend reconnects
• local config smoke: `http://127.0.0.1:3210/api/config\` reports xAI STT `fr`, `smartTurnTimeoutMs: 1200`, latency defaults, and no API key exposure