fix(audio): low-samplerate ogg encode + post-2.0 QA hygiene

Quality-VBR ogg (libvorbis -q:a) fixes 8 kHz 'encoder setup failed' in both ogg paths; drop empty COOKIE_SECRET ENV (app auto-generates); emit real bundle extractedSize; fix stale image-pad/compress-pdf QA specs.

docker/Dockerfile

@@ -373,8 +373,10 @@ ENV PORT=1349 \
     LOG_DIR=/data/logs \
     TRUST_PROXY=true \
     OIDC_ENABLED=false \
-    EXTERNAL_URL= \
-    COOKIE_SECRET=
+    EXTERNAL_URL=
+
+# COOKIE_SECRET is intentionally not baked in: the app auto-generates and persists one
+# on first boot if unset (see apps/api/src/index.ts). Override via runtime env to pin it.
 
 # NVIDIA Container Toolkit env vars (harmless on non-GPU systems)
 ENV NVIDIA_VISIBLE_DEVICES=all \

docker/build-bundle.sh

@@ -361,6 +361,15 @@ model_ids = [m["id"] for m in bundle.get("models", [])]
 
 py_ver = f"{sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}"
 
+# Uncompressed bundle size: BUILD_DIR holds site-packages + models at this point.
+# Surfaces the real extractedSize for docker/feature-manifest.json (used by the
+# disk-space pre-check in install_feature.py); several manifest entries were 0 before.
+extracted_size = sum(
+    os.path.getsize(os.path.join(root, name))
+    for root, _dirs, files in os.walk(os.environ["BUILD_DIR"])
+    for name in files
+)
+
 bundle_meta = {
     "bundleId": bundle_id,
     "version": manifest["imageVersion"],
@@ -368,6 +377,7 @@ bundle_meta = {
     "imageVersion": manifest["imageVersion"],
     "pythonVersion": py_ver,
     "models": model_ids,
+    "extractedSize": extracted_size,
 }
 
 out_path = os.path.join(os.environ["BUILD_DIR"], "bundle.json")