worker+voice: per-conn context, store error hygiene, StateDir wiring, pipe leak

worker/server.go: dispatch now receives a per-connection context instead of
context.Background(), so handler cancellation propagates on conn close.

voice/server.go: same — per-conn context fed through safeDispatch into
HandlePushToTalk instead of context.Background().

store/reminders.go: propagate LastInsertId error.
store/nudges.go: propagate LastInsertId and RowsAffected errors.
store/tools.go: propagate RowsAffected error.

config/config.go: applyDefaults now respects StateDir when set, using it as
the base for empty DBPath/SocketPath instead of silently ignoring it.

phraser/llmphraser.go: close stderr pipe fd when cmd.Start() fails.

internal/voice/server.go

@@ -123,6 +123,8 @@ func (s *Server) Serve() error {
 // on EOF / read error / ctx cancel.
 func (s *Server) serveConn(c net.Conn) {
 	defer c.Close()
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
 	// TODO(step-up): the auth handshake populates the surface from mTLS /
 	// passkey enrollment. Today the floor sets SurfacePCClient (the
 	// reference client's surface, capped at L3 per auth.MaxLayer). The
@@ -145,7 +147,7 @@ func (s *Server) serveConn(c net.Conn) {
 		}
 		s.sessions.Touch(sess.ID, time.Now())
 
-		result, err := s.safeDispatch(c.RemoteAddr(), sess.ID, req)
+		result, err := s.safeDispatch(ctx, c.RemoteAddr(), sess.ID, req)
 		resp := Response{ID: req.ID}
 		if err != nil {
 			resp.Error = rpcErr(err)
@@ -159,13 +161,13 @@ func (s *Server) serveConn(c net.Conn) {
 	}
 }
 
-func (s *Server) safeDispatch(addr net.Addr, sid uint64, req Request) (result json.RawMessage, err error) {
+func (s *Server) safeDispatch(ctx context.Context, addr net.Addr, sid uint64, req Request) (result json.RawMessage, err error) {
 	defer func() {
 		if r := recover(); r != nil {
 			err = fmt.Errorf("voice: panic dispatching %s (sid %d): %v", req.Method, sid, r)
 		}
 	}()
-	return s.dispatch(context.Background(), sid, req)
+	return s.dispatch(ctx, sid, req)
 }
 
 func (s *Server) dispatch(ctx context.Context, sid uint64, req Request) (json.RawMessage, error) {