feat(vocero): add linked content and TALKFIRST greetings (#2)

Opening a report or podcast link now establishes an authenticated starting reference for the conversation. Users can select other accessible content or compare reports while retaining the original link, and TALKFIRST greetings can name the verified report or podcast.

Release notes:

- Added authenticated report and episode link resolution with bounded lookups and unavailable-content handling
- Added explicit conversation selection without restricting searches or changing the reference during comparisons
- Added contextual TALKFIRST greetings through both voice-proxy and HTTP reasoning paths
- Preserved backend permission checks, conversation isolation, cancellation, and the existing speech protocol

Reviewed-on: AquaPortal/s2s#2

docs/client/tool-calling.md

@@ -16,7 +16,7 @@ fallback on this path. AquaPortal checks current permissions on every request,
 including its administrator and assigned report-manager access rules.
 
 The backend phone login must return `sessionToken` plus `user.id` and `user.name`.
-The only allowed tool names are:
+The allowed backend tool names are:
 
 | Tool | Content |
 |---|---|
@@ -64,11 +64,47 @@ Generation checks reject late results even if the transport does not stop in
 time. The browser receives `vocero.tool.started` / `vocero.tool.failed` status
 events, without backend credentials or raw tool arguments.
 
-Automatic current-episode context from `episode_id` is not wired yet. The model
-must resolve a podcast with the catalog rather than fetching an unauthenticated
-episode URL. See [usage](usage.md#authenticated-aquaportal-mcp) for configuration,
-conversation endpoints, single-worker constraints, and the retained unsafe
-phone selector.
+Conversation creation accepts optional `report_id` and `episode_id` selectors.
+The server resolves them using the authenticated MCP client, retaining only
+verified IDs, titles, dates, and podcast availability. Report podcasts use
+`report:<full-report-id>`; daily episodes use `daily:<episode-id>`. When both
+selectors are present, the explicit daily episode determines the podcast and
+the report remains a separate reference. A missing daily episode never falls
+back to the report podcast. Link resolution has a ten-second total budget;
+unavailable content permits a generic conversation, while invalid authentication
+still prevents startup. No public episode endpoint is used.
+
+The original link and current selection are separate, immutable metadata
+objects owned by each conversation. The model uses the current selection for
+"this report/episode" and the original link for "the report from the link".
+`get_podcast` and `read_podcast_transcript` receive the current podcast through
+`X-Vocero-Podcast-Id`; explicit `podcast_id` arguments override the header.
+Every retrieval still checks backend permissions. Search and comparison calls
+receive only their requested filters and do not change the current selection.
+
+Vocero adds one local tool, `select_content`, to the discovered catalog:
+
+```json
+{"request":{"kind":"report","id":"report-example"}}
+```
+
+`kind` is `report` or `podcast`; podcast selections use the prefixed ID. This
+action performs an authorized lookup before replacing the current selection.
+It preserves the original link and changes no backend data. Choosing a report
+without a podcast or a daily podcast clears the previous, unrelated reference.
+Failed, ambiguous, or cancelled lookups do not replace the selection. Reading
+another report for comparison alone never invokes this action. Both reasoning
+paths refresh their instructions after a successful selection.
+
+TALKFIRST opening instructions mention the linked report's verified title, or
+the linked podcast's title when no report is available. They invite questions
+about this or other accessible content without an unsolicited summary. Missing
+content gets a brief explanation without exposing an inaccessible title. The
+opening instruction is consumed after the first completed answer. TALK and
+manual startup retain their existing greeting behavior.
+
+See [usage](usage.md#authenticated-aquaportal-mcp) for configuration, conversation
+endpoints, single-worker constraints, and the retained unsafe phone selector.
 
 ## Native realtime function calls