Run first production transcription smoke test

Run a bounded end-to-end transcription through the production Murmur API using the first 90 seconds of public VOD source `video_edits/4750/9359.mp4`, then remove temporary media and GPU resources. Verified outcome: - OAuth submission from the allowlisted Kaukus host succeeded as job `a3b967bc-121e-48cb-9c4d-adfa83fd3950`. - The 90-second mono AAC derivative was fetched over temporary HTTPS, transcribed in one attempt, and completed in about 39.6 seconds after the worker became ready. - Output used `NbAiLab/nb-whisper-large`, contained 7 segments and 96 aligned words, and produced coherent Bokmål text beginning with the Skien council welcome and opening song. - L4 capacity was unavailable in every listed zone. A disposable `RENDER-S` Tesla P100 was used at €1.221/hour. - The production worker image could not run unchanged on P100: CTranslate2 rejected float16, and bundled PyTorch no longer supports CUDA capability 6.0 for VAD/alignment. For this disposable worker only, ASR used CTranslate2 CUDA float32 while Silero VAD and alignment ran on CPU. - Provisioning originally lacked Block Storage permission; the project-scoped dedicated IAM policy now has `InstancesFullAccess` and `BlockStorageFullAccess`. Further least-privilege reduction remains needed. - The job result persisted in PostgreSQL. The disposable GPU server, IP, volumes, temporary SSH key/rule, public media route/file and stale worker row were removed. Worker provisioning is disabled again and HTTPS health remains 204. Follow-ups: - Make compute type, VAD backend and alignment device explicit worker configuration if P100 fallback is supported; otherwise restrict configured worker types to GPUs supported by the locked PyTorch build. - Add multi-zone, zone-specific security-group support and capacity-aware fallback. - Investigate why automatic idle teardown did not remove the worker after the configured 60 seconds. - Narrow the dedicated Scaleway policy after identifying the exact v2alpha1 and Block Storage permissions. - Remove the root-owned temporary token/script/result files from the Kaukus host when SSH signing access is available; the access token is locally rejected by Murmur after one hour.