feat(brain-realtime): OpenAI wss client pump (spec §4)

Builds session.update with turn_detection: null on handshake (S4,
encoded in the translator's build_openai_session_update; Task 4).
Runs a select! loop over tap-side input (audio_in → append,
function_call_output → conversation.item.create) and OpenAI-side
input (response.audio.delta → tap audio_out, speech_started/stopped
→ tap speech_started/stopped, function_call_arguments.done → tap
function_call). 401 surfaces as OpenAiClientError::AuthFailed.

URL + headers shape tested directly. Full pump loop tested via
MockRealtimeBrain in Task 10 — neither side of this pump is a real
network endpoint in unit tests.

Cargo.lock

@@ -1208,6 +1208,7 @@ dependencies = [
  "async-trait",
  "base64",
  "futures-util",
+ "http",
  "rutster-media",
  "rutster-tap",
  "serde",