fix(voice): refresh callable API keys before streamed STT

[sylvesterkaczmarek]

Summary

Refresh callable or rotating AsyncOpenAI API keys before opening the streamed STT WebSocket connection.

The OpenAI Python client supports API-key providers and refreshes them before normal requests. Streamed STT opens its WebSocket manually, however, and currently reads client.api_key directly for the Authorization header without invoking the client's refresh hook first. With a callable key provider, that can send the initial empty/stale key instead of the current credential.

The Responses WebSocket transport in this SDK already performs the same refresh before preparing its handshake.

Fix

• invoke the OpenAI client's refresh hook when available before the streamed-STT handshake
• keep the refresh feature-detected so compatible custom clients without the hook remain unchanged
• build the existing authorization header only after refresh completes

Test plan

Added a focused regression with a rotating client whose initial API key is empty and whose refresh hook installs a new key. The test verifies that:

• the refresh hook is called exactly once before the handshake
• the WebSocket Authorization header contains the refreshed key

The branch is based directly on current main at 7e55afc9500d12937687988f1e91e900dcb4ad09 and is 0 commits behind it. The production change is limited to the refresh helper and one pre-handshake call.

Risk

Low. Static API keys behave as before. The additional work only occurs when the supplied OpenAI client exposes the refresh hook used for dynamic credentials.

Issue number

None. Found while auditing streamed STT parity with the existing Responses WebSocket authentication path.

[seratch]

Thanks for the contribution. Callable API keys do need to be refreshed before the manual streamed-STT WebSocket handshake, and the regression test captures the relevant failure.

However, #4532 is already changing the same handshake and its current review requires this refresh behavior. Please move the refresh helper and test into #4532, using the shared OpenAI-client WebSocket utility there, and close #4537 so this connection path is corrected in one PR.