feat: HTTP TTS 与双端兼容朗读，书架体验与自定义设置

朗读（Closes #13 的朗读部分）

新增服务端 HTTP TTS 代理与客户端第二、第三个朗读引擎，三者在同一个
SpeechEngine 接口下可切换：

- 服务端 GET /api/v1/tts 代理 TTS_URL 指向的合成服务（edge-tts / Piper
  等兼容形态），只代理不内置合成模型；GET /api/v1/tts/voices 回答
  「这个实例能用什么」，未配置时返回 http:false 而不是 404。
  按句合成、磁盘缓存、上游返回非 audio/* 时明确报错（一个指到网页的
  TTS_URL 会以 200 返回 HTML，塞进 audio 里既没声音也没事件）。
  /tts 是精确的查询串令牌白名单项之一：<audio src> 无法带 Authorization。
- 客户端 HttpTtsEngine 用 <audio> 而不是 Web Audio，事件驱动推进队列。
- 客户端 NativeTtsEngine 走 Android 外壳新增的 speech 接口（shell v3）：
  WebView 自带的合成器与系统的是两个引擎，手机系统装好的中文语音经常
  不在 getVoices() 里，这是「朗读没有中文声音」最常见的原因。
- speechAvailability 决定 auto 用哪个引擎：native → system → http。
- 原 TtsEngine 抽出 loadQueue/onChunk/onState 为公开字段以结构化满足接口。

书架

- 排序：最近更新 / 最近入库 / 书名 / 作者，中文按数字大小排。
  排序规则抽到 shelf-order.ts，离线路径与服务端用同一条规则。
- 密度、作者显隐、封面进度条；搜索一键清空 + 回车即搜；下拉刷新。
- 服务端 BookDto 增加 addedAt，否则客户端离线排序无法复现服务端结果。

自定义设置

- 朗读引擎可选（引擎多于一个时才显示该行）；音调行只对有声调的引擎出现。
- 书架设置独立成 sheet，与阅读面板分开。

测试与文档

- server: tts.test.ts（10 例）。web: tts-http / speech / shelf-order
  新增 39 例，合计 245 passing。
- android/scripts/check-shell.sh 修正为同时校验嵌套的 speech 接口，
  之前它只能看到一个顶层接口。
- README / docs/api.md / docs/architecture.md 补齐三个引擎的取舍、
  环境变量与错误码。

Ref: #13

android/scripts/check-shell.sh

@@ -45,15 +45,59 @@ done
 
 # 3. Every bridge method the web client calls must exist, and every bridge method
 #    the shell exposes must be declared. This is the cross-language seam.
+#
+#    There are two interfaces, not one. `ReaderAndroid` is the top-level object;
+#    `SpeechBridge` is registered as a *separate* interface on the platform side
+#    (`addJavascriptInterface` can expose objects, not properties of one) and the
+#    web layer re-parents it onto `ReaderAndroid.speech`. So the check walks both
+#    declarations against both implementations — comparing the nested interface's
+#    methods against `ReaderBridge.kt` is what produced eleven false failures the
+#    first time this was run.
 note "==> checking the JS bridge contract in both directions"
 bridge_file="$android_dir/app/src/main/java/cool/cnb/reader/bridge/ReaderBridge.kt"
-declared=$(sed -n 's/^    fun \([A-Za-z][A-Za-z0-9_]*\)(.*/\1/p' "$bridge_file" | sort -u)
+speech_file="$android_dir/app/src/main/java/cool/cnb/reader/bridge/SpeechBridge.kt"
 types_file="$repo_dir/web/src/android-bridge.d.ts"
-consumed=$(sed -n 's/^  \([a-z][A-Za-z0-9_]*\)[?]\?(.*:.*;.*$/\1/p' "$types_file" | sort -u)
 
-for method in $consumed; do
-  if ! printf '%s\n' "$declared" | grep -qx "$method"; then
-    err "web client calls ReaderAndroid.$method() but ReaderBridge.kt does not declare it"
+# A method is "implemented" if either bridge class has it at method indentation.
+# Both files are searched for both interfaces: the Kotlin class a method happens
+# to live in is an implementation detail, not part of the contract.
+implemented=$(sed -n 's/^    fun \([A-Za-z][A-Za-z0-9_]*\)(.*/\1/p' "$bridge_file" "$speech_file" | sort -u)
+
+# The declaration side has two shapes, and the difference matters:
+#
+#   - top-level members are `name(args): type;` inside `interface AndroidBridge`;
+#   - `speech` is a *property* whose type is a nested interface, and the nested
+#     interface's own methods are the second shape.
+#
+# Reading only the first shape is what let the speech methods go unchecked; reading
+# only the second is what made an early version of this check fail on every
+# ordinary method of the first.
+declared_top=$(sed -n 's/^  \([a-z][A-Za-z0-9_]*\)[?]\{0,1\}(.*/\1/p' "$types_file" | sort -u)
+# The nested interface's members, delimited by its own declaration.
+nested_block=$(sed -n '/^export interface SpeechBridge {/,/^}/p' "$types_file")
+declared_nested=$(printf '%s\n' "$nested_block" | sed -n 's/^  \([a-z][A-Za-z0-9_]*\)[?]\{0,1\}(.*/\1/p' | sort -u)
+
+for method in $declared_top $declared_nested; do
+  if ! printf '%s\n' "$implemented" | grep -qx "$method"; then
+    err "android-bridge.d.ts declares $method() but no bridge class implements it"
+  fi
+done
+
+# The nested interface must be exposed, or the re-parenting in
+# `promoteSpeechInterface` would attach nothing at runtime.
+if printf '%s\n' "$declared_top" | grep -qx "speech"; then
+  if ! grep -q '^    fun speech()' "$bridge_file"; then
+    err "android-bridge.d.ts declares ReaderAndroid.speech but ReaderBridge.kt does not expose it"
+  fi
+fi
+
+# Every implemented method must also be declared, or the next person writing
+# client code will not know it is available. `speech()` is the exception: it is
+# declared as the nested interface's name, not as a method returning one.
+for method in $implemented; do
+  [ "$method" = "speech" ] && continue
+  if ! printf '%s\n%s\n' "$declared_top" "$declared_nested" | grep -qx "$method"; then
+    err "a bridge class implements $method() but android-bridge.d.ts does not declare it"
   fi
 done
 
@@ -87,17 +131,6 @@ for mediaType in "image/jpeg" "image/png" "image/webp"; do
   fi
 done
 
-# Every bridge method must also appear in the client-facing declaration, or the
-# next person writing client code will not know it is available.
-missing_from_types=0
-for method in $declared; do
-  if ! printf '%s\n' "$consumed" | grep -qx "$method"; then
-    err "ReaderBridge.$method exists but is missing from android-bridge.d.ts"
-    missing_from_types=1
-  fi
-done
-[ "$missing_from_types" -eq 0 ] || true
-
 if [ "$fail" -ne 0 ]; then
   note "==> shell checks failed"
   exit 1