fix: voice_recognition uses constants for credentials and paths

The cog did its own netrc read from a hardcoded /home/pi/.netrc at import
time, crashing on any other host. Now:

- constants.py: ASSEMBLYAI_API_KEY resolved like every other token
  (env ASSEMBLYAI_API_KEY -> netrc machine 'assemblyai' at
  CONJURER_NETRC_FILE); new TRANSCRIPTS_PATH (env
  CONJURER_TRANSCRIPTS_PATH, defaults next to the log file, created by the
  runtime layout)
- voice_recognition_commands.py: drop the hardcoded netrc read and
  transcript dir; when the key is missing raise a clear RuntimeError so
  the guarded loader disables ONLY this cog with a readable reason
- bot.env.example: document ASSEMBLYAI_API_KEY

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

constants.py

@@ -189,6 +189,13 @@ DIR_PATH_SADOX = os.getenv("CONJURER_SADOX_DIR", DIR_PATH_SADOX)
 ENCODING = os.getenv("CONJURER_ENCODING", ENCODING)
 SEPARATOR_FILE_PATH = os.getenv("CONJURER_PATH_SEPARATOR", SEPARATOR_FILE_PATH)
 
+# Voice-recognition transcript dumps. Defaults next to the log file (so on the
+# Pi it lands in /home/pi/Conjurer/transcripts/, in docker under /data).
+TRANSCRIPTS_PATH = os.getenv(
+    "CONJURER_TRANSCRIPTS_PATH",
+    os.path.join(os.path.dirname(LOGFILE) or ".", "transcripts") + os.sep,
+)
+
 FILE_SERVICE_ADDRESS = os.getenv("CONJURER_FILE_SERVICE", "http://192.168.1.15:5000")
 RADIO_HARBOR_ADDRESS = os.getenv("CONJURER_RADIO_HARBOR", "http://192.168.1.15:54321")
 SKIP_TRACK = os.getenv("CONJURER_SKIP_ENDPOINT", "/skip")
@@ -247,6 +254,7 @@ def _ensure_runtime_layout() -> None:
         LOGSTORE,
         GRAPHICS_PATH,
         MUSIC_FOLDER,
+        TRANSCRIPTS_PATH,
     ):
         _ensure_dir(directory)
 
@@ -327,6 +335,9 @@ else:
 
 TOKEN = _resolve_token("discord", "DISCORD_TOKEN")
 
+# Voice recognition (AssemblyAI). None = the voice cog reports and disables.
+ASSEMBLYAI_API_KEY = _resolve_token("assemblyai", "ASSEMBLYAI_API_KEY")
+
 if spotipy:
     _spotify_creds = _load_netrc_credentials("spotipy")
     if _spotify_creds and SpotifyClientCredentials: