feat(eo): align correction EO on 3.6a format + Deepgram token + T1 presentation generation

Sprint 4a:
- correctEO aligned on CorrectionRapport format (revelation, diagnostic, criteres, conseil_nclc, erreurs_codes)
- nclc_cible parameter (default 9, accepts 9|10)
- Fire-and-forget modele + exercices jobs (same pattern as EE)
- EO-specific DeepSeek prompt (oral transcript tolerance, 4 TCF criteria)
- Gemini transcribeAudio: 30s timeout + 1 retry
- POST /presentations/generate: 5-field questionnaire → DeepSeek generates oral presentation (~220-260 words, NCLC 7-8)
- Migration 006_sprint_4a_eo.sql (documentation only — no audio storage)

Sprint 4b:
- POST /transcriptions/token: Deepgram temporary API key (600s TTL)
- Removed audio storage pipeline (audioStorage.ts, XOR validation, 14MB limit)
- Backend receives transcript text only, no audio files
- TD-10/TD-11 resolved (Sprint 3.6c), TD-16/17/18 resolved (4b cleanup)

Typecheck: OK · Tests: 241/241 ✅

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/deepgram.ts

@@ -0,0 +1,53 @@
+/**
+ * Client Deepgram — Sprint 4b.
+ *
+ * Génère un token éphémère que le frontend utilise pour ouvrir une connexion
+ * directe à Deepgram (transcription live). Le token a une durée de vie courte
+ * (par défaut 600 s) et n'expose pas la clé maître `DEEPGRAM_API_KEY`.
+ *
+ * Endpoint : POST https://api.deepgram.com/v1/auth/grant
+ * Doc : https://developers.deepgram.com/docs/create-temporary-api-key
+ */
+
+const DEEPGRAM_API_KEY = process.env.DEEPGRAM_API_KEY ?? "";
+const DEEPGRAM_BASE_URL = "https://api.deepgram.com";
+const DEEPGRAM_TIMEOUT_MS = 10_000;
+
+export interface DeepgramToken {
+  token: string;
+  expires_in: number;
+}
+
+export async function createTemporaryToken(
+  ttlSeconds: number,
+): Promise<DeepgramToken> {
+  const response = await fetch(`${DEEPGRAM_BASE_URL}/v1/auth/grant`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Token ${DEEPGRAM_API_KEY}`,
+    },
+    body: JSON.stringify({ ttl_seconds: ttlSeconds }),
+    signal: AbortSignal.timeout(DEEPGRAM_TIMEOUT_MS),
+  });
+
+  if (!response.ok) {
+    throw new Error(
+      `Deepgram API error: ${response.status} ${response.statusText}`,
+    );
+  }
+
+  const data = (await response.json()) as {
+    access_token?: string;
+    expires_in?: number;
+  };
+
+  if (typeof data.access_token !== "string" || data.access_token.length === 0) {
+    throw new Error("Deepgram API: access_token manquant dans la réponse");
+  }
+
+  const expiresIn =
+    typeof data.expires_in === "number" ? data.expires_in : ttlSeconds;
+
+  return { token: data.access_token, expires_in: expiresIn };
+}