feat: initial commit of astra local voice agent

Lokaler deutscher Sprachagent für Apple Silicon: Pipecat-Pipeline mit
Nemotron-ASR (MLX), Qwen über natives Ollama /api/chat, und Pocket TTS.
Loopback-only WebRTC-Server mit Origin/Host-Härtung.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVgSHNHdRx3UNTBodFmhRA

tests/test_server.py

@@ -0,0 +1,45 @@
+from fastapi.testclient import TestClient
+
+from astra.server import create_app
+
+
+def test_status_and_static_ui_work_before_models_are_ready():
+    with TestClient(create_app(load_models=False), base_url="http://localhost:7860") as client:
+        status = client.get("/api/status")
+        assert status.status_code == 200
+        assert status.json()["thinking"] is False
+        assert status.json()["ready"] is False
+        page = client.get("/")
+        assert "Einfach aussprechen" in page.text
+        assert "frame-ancestors 'none'" in page.headers["content-security-policy"]
+        assert client.get("/static/app.js").status_code == 200
+
+
+def test_other_websites_cannot_open_a_microphone_session():
+    with TestClient(create_app(load_models=False), base_url="http://localhost:7860") as client:
+        for origin in ["https://evil.example", "null", "http://localhost.evil.example:7860"]:
+            response = client.post("/api/offer", headers={"Origin": origin}, json={})
+            assert response.status_code == 403
+        assert client.post("/api/offer", json={}).status_code == 403
+
+
+def test_unready_returns_actionable_status_and_invalid_sdp_is_rejected():
+    with TestClient(create_app(load_models=False), base_url="http://localhost:7860") as client:
+        headers = {"Origin": "http://localhost:7860"}
+        assert client.post("/api/offer", headers=headers, json={}).status_code == 422
+        response = client.post(
+            "/api/offer", headers=headers, json={"sdp": "a" * 20, "type": "offer"}
+        )
+        assert response.status_code == 503
+        assert response.json()["detail"]
+
+
+def test_disconnect_is_idempotent_and_host_is_checked():
+    with TestClient(create_app(load_models=False), base_url="http://localhost:7860") as client:
+        response = client.post(
+            "/api/disconnect",
+            headers={"Origin": "http://localhost:7860"},
+            json={"pc_id": "already-gone"},
+        )
+        assert response.json() == {"ok": True}
+        assert client.get("/api/status", headers={"Host": "evil.example"}).status_code == 403