[codex] Stabilize Modulate STT unit tests on Windows

[tianmind-studio]

Summary

• stub websocket/prometheus/heavy imports so test_modulate_stt.py can collect on Windows without installing optional realtime STT dependencies
• keep Modulate socket close tests from waiting on the receive loop during mocked cancellation
• update prerecorded routing patches for the current stt_prerecorded_models list setting
• make the action-item test stubs reuse existing packages and attach child modules so collecting it after Modulate does not remove utils.stt from the parent package

Review follow-up

• Removed the previous Parakeet WebSocket runtime auth-header change. This PR is now test-only and no longer sends ENCRYPTION_SECRET to the Parakeet service.
• Current head: 4b198e757f.

Validation

• python -m pytest backend\\tests\\unit\\test_modulate_stt.py -q --tb=short -> 91 passed
• python -m pytest backend\\tests\\unit\\test_action_item_date_validation.py backend\\tests\\unit\\test_modulate_stt.py -q --tb=short -> 117 passed
• python -m pytest backend\\tests\\unit\\test_modulate_stt.py backend\\tests\\unit\\test_action_item_date_validation.py -q --tb=short -> 117 passed
• python -m py_compile backend\\tests\\unit\\test_modulate_stt.py backend\\tests\\unit\\test_action_item_date_validation.py backend\\utils\\stt\\streaming.py
• python -m black --line-length 120 --skip-string-normalization --check backend\\tests\\unit\\test_modulate_stt.py backend\\tests\\unit\\test_action_item_date_validation.py backend\\utils\\stt\\streaming.py
• git diff --check origin/main...HEAD
• scripts/pre-commit with the backend venv on PATH

[kodjima33]

Backend (stabilize Modulate STT tests; touches streaming.py) — approve only per policy.

[ThomsenDrake]

ClawSweeper local pilot review

Recommendation: keep open, but do not merge as-is.

What it found:

• The Windows test-stabilization goal is useful.
• The runtime change sends ENCRYPTION_SECRET as outbound Parakeet WebSocket authorization. That secret is the backend data-encryption master secret.
• Current Parakeet /v3/stream behavior does not validate that header, so this broadens secret exposure without creating an enforced auth boundary.
• The streaming auth contract is also missing docs, and proof is mock-only.

Suggested next step: use a dedicated Parakeet service credential with server-side validation, update tests/charts/docs for that contract, or keep this PR test-only.

Posted from a local report-only ClawSweeper pilot by request; no labels, closes, repairs, or merges were performed.