Fix path traversal, temp file leak, cross-browser speech, and add tests

app.js

@@ -6,7 +6,8 @@ env.allowLocalModels = false;
 let progressCallback = (progress) => {
     const status = document.getElementById('status');
     if (progress.status === 'progress') {
-        status.textContent = `Downloading model... ${progress.file}`;
+        const pct = progress.progress != null ? ` ${Math.round(progress.progress)}%` : '';
+        status.textContent = `Downloading model... ${progress.file}${pct}`;
     } else if (progress.status === 'done') {
         status.textContent = 'Model loaded';
     }
@@ -27,7 +28,7 @@ let recognition;
 let transcriber = null;
 let currentModel = null;
 
-const getModelForLanguage = () => 'Xenova/whisper-small';
+const getModelForLanguage = (_lang) => 'Xenova/whisper-small';
 
 fileInput.addEventListener('change', () => {
     uploadBtn.disabled = !fileInput.files.length;
@@ -94,7 +95,12 @@ recordBtn.addEventListener('click', async () => {
     try {
         await navigator.mediaDevices.getUserMedia({ audio: true });
 
-        recognition = new webkitSpeechRecognition();
+        const SpeechRecognition = window.SpeechRecognition || window.webkitSpeechRecognition;
+        if (!SpeechRecognition) {
+            status.textContent = 'Speech recognition not supported in this browser';
+            return;
+        }
+        recognition = new SpeechRecognition();
         recognition.continuous = true;
         recognition.interimResults = true;
         recognition.lang = languageSelect.value;