feat(denoise): add self-hosted DeepFilterNet 3 ML noise-suppression model

Integrate DeepFilterNet 3 (deepfilternet3-noise-filter@1.2.1) as a new
client-side denoise model id 'deepfilternet', mirroring the DTLN pattern.

The npm package ships only an ESM whose AudioWorklet processor + wasm-bindgen
glue are inlined as a string (loaded via a Blob URL — no CDN for the worklet).
Its only runtime fetches are a single-threaded df_bg.wasm and an ONNX model
tarball, which previously loaded from an external CDN. We now VENDOR both
(build/denoise-vendor/deepfilternet/v2/...) and self-host them under
denoise/deepfilternet/, overriding the package's cdnUrl so nothing hits the
upstream CDN — keeping it self-hosted / Tauri-CSP safe.

The wasm is single-threaded (no SharedArrayBuffer / atomics / imported shared
memory), so it needs no COOP/COEP cross-origin isolation and runs fine in EC's
non-isolated iframe. Runs at 48 kHz fullband. Any init/runtime failure falls
back to the raw mic, like the other models.

- vite.config.js: copy ESM + vendored wasm/model into the EC denoise dir with a
  required-asset guard that aborts the build if any entry is missing.
- build/lotus-denoise.js: 'deepfilternet' branch — dynamic-import the ESM, build
  a DeepFilterNet3Core pointed at the self-hosted base, await init, return the
  worklet node; 48 kHz; raw-mic fail-safe preserved.
- denoisePipeline.ts: 'deepfilternet' branch for the in-app tester + sampleRate.
- settings.ts: add 'deepfilternet' to DenoiseModelId + getSettings whitelist.
- lotusDenoiseUtils.ts: add the comparison-chart row.
- General.tsx: add the "DeepFilterNet 3 (beta)" dropdown option.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/state/settings.ts

@@ -14,10 +14,12 @@ export type MessageSpacing = '0' | '100' | '200' | '300' | '400' | '500';
 //  - 'browser' : WebRTC built-in suppression (Element Call noiseSuppression param)
 //  - 'ml'      : client-side RNNoise ML suppression (Lotus denoise shim)
 export type NoiseSuppressionMode = 'off' | 'browser' | 'ml';
-// Self-hostable, build-bundled ML models. DeepFilterNet remains excluded — it
-// loads its runtime/models from external CDNs, which breaks the self-hosted /
-// Tauri-CSP strategy (see LOTUS_DENOISE_ENGINEERING_REVIEW.md).
-export type DenoiseModelId = 'rnnoise' | 'speex' | 'dtln';
+// Self-hostable, build-bundled ML models. DeepFilterNet 3 is included via
+// deepfilternet3-noise-filter with its df_bg.wasm + ONNX model VENDORED and
+// self-hosted (its cdnUrl is overridden), so it no longer depends on an external
+// CDN. Its wasm is single-threaded, so no COOP/COEP cross-origin isolation is
+// required (see LOTUS_DENOISE_ENGINEERING_REVIEW.md).
+export type DenoiseModelId = 'rnnoise' | 'speex' | 'dtln' | 'deepfilternet';
 export type ChatBackground =
   | 'none'
   | 'blueprint'
@@ -260,12 +262,13 @@ export const getSettings = (): Settings => {
             ? 'browser'
             : 'off'
           : (saved.callNoiseSuppression ?? defaultSettings.callNoiseSuppression),
-      // Coerce any retired/unknown persisted model (e.g. 'dtln', 'deepfilternet'
-      // from earlier beta builds) back to the default working model.
+      // Coerce any retired/unknown persisted model back to the default working
+      // model; only whitelisted ids pass through.
       callDenoiseModel:
         saved.callDenoiseModel === 'rnnoise' ||
         saved.callDenoiseModel === 'speex' ||
-        saved.callDenoiseModel === 'dtln'
+        saved.callDenoiseModel === 'dtln' ||
+        saved.callDenoiseModel === 'deepfilternet'
           ? saved.callDenoiseModel
           : defaultSettings.callDenoiseModel,
       composerToolbarButtons: {