feat(brain-realtime): OpenAI wss client pump (spec §4)

Builds session.update with turn_detection: null on handshake (S4,
encoded in the translator's build_openai_session_update; Task 4).
Runs a select! loop over tap-side input (audio_in → append,
function_call_output → conversation.item.create) and OpenAI-side
input (response.audio.delta → tap audio_out, speech_started/stopped
→ tap speech_started/stopped, function_call_arguments.done → tap
function_call). 401 surfaces as OpenAiClientError::AuthFailed.

URL + headers shape tested directly. Full pump loop tested via
MockRealtimeBrain in Task 10 — neither side of this pump is a real
network endpoint in unit tests.

Cargo.toml

@@ -54,3 +54,8 @@ url = "2"
 base64 = "0.22"
 # async-trait 0.1: async fns in trait objects (Tool trait, slice-3 spec §6.1).
 async-trait = "0.1"
+# http 1: Request/Response builders for the OpenAI WS handshake (slice-3
+# spec §5.3). Task 9's main.rs builds the http::Request<...> the tungstenite
+# client sends before WS upgrade; `openai_client::openai_headers` produces
+# the header pairs the caller stuffs into it.
+http = "1"