fix(whatsapp-cloud): review follow-ups for #43921

- nous_subscription: gate the STT managed-default flip on openai-audio
  entitlement and skip when a local backend (faster-whisper or custom
  command) works; new _local_stt_backend_available() helper + tests
- whatsapp_cloud: WHATSAPP_CLOUD_{DM_POLICY,ALLOW_FROM,GROUP_POLICY,
  GROUP_ALLOW_FROM} env overrides so both adapters can run in parallel;
  normalize allowlist entries (JID/punctuation) to bare wa_id
- whatsapp_cloud: wrap per-message event build in try/except (dedup-marked
  wamids would be silently dropped on Meta's batch retry otherwise)
- whatsapp_cloud: validate media_id before URL/filename interpolation,
  delete transient .ogg after voice upload, FIFO-cap interactive-button
  state dicts and per-chat wamid cache
- whatsapp_common: '# **Title**' headers no longer double-wrap asterisks
- setup wizard: read access token / app secret via getpass on TTYs
- docs: new WHATSAPP_CLOUD_* gating env vars

tests/hermes_cli/test_nous_subscription.py

@@ -723,6 +723,10 @@ def test_apply_nous_managed_defaults_flips_stt_provider_to_openai_for_nous_users
     gateway transcribes their voice notes without needing faster-whisper
     installed."""
     monkeypatch.setattr(ns, "get_env_value", lambda name: "")
+    monkeypatch.setattr(ns, "resolve_openai_audio_api_key", lambda: "")
+    # CI installs [all] extras, so faster-whisper is importable there —
+    # force the "no local backend" case this test is about.
+    monkeypatch.setattr(ns, "_local_stt_backend_available", lambda: False)
     # Avoid the heavy real probing in get_nous_subscription_features.
     monkeypatch.setattr(
         ns,
@@ -751,6 +755,66 @@ def test_apply_nous_managed_defaults_flips_stt_provider_to_openai_for_nous_users
     assert config["stt"]["provider"] == "openai"
 
 
+def _stt_features_stub(*, account_info):
+    return ns.NousSubscriptionFeatures(
+        subscribed=True,
+        nous_auth_present=True,
+        provider_is_nous=True,
+        account_info=account_info,
+        features={
+            key: ns.NousFeatureState(
+                key=key, label=key, included_by_default=True,
+                available=False, active=False, managed_by_nous=False,
+                direct_override=False, toolset_enabled=False,
+                explicit_configured=False,
+            )
+            for key in ("web", "image_gen", "video_gen", "tts", "stt", "browser", "modal")
+        },
+    )
+
+
+def test_apply_nous_managed_defaults_keeps_local_stt_when_backend_works(monkeypatch):
+    """A working local backend (faster-whisper installed or custom command)
+    is a strong intent signal — never flip it to the managed gateway."""
+    monkeypatch.setattr(ns, "get_env_value", lambda name: "")
+    monkeypatch.setattr(ns, "resolve_openai_audio_api_key", lambda: "")
+    monkeypatch.setattr(ns, "_local_stt_backend_available", lambda: True)
+    monkeypatch.setattr(
+        ns,
+        "get_nous_subscription_features",
+        lambda config, **kw: _stt_features_stub(
+            account_info=_account(logged_in=True, paid=True)
+        ),
+    )
+
+    config = {"stt": {"provider": "local"}}
+    changed = ns.apply_nous_managed_defaults(config, enabled_toolsets=[])
+
+    assert "stt" not in changed
+    assert config["stt"]["provider"] == "local"
+
+
+def test_apply_nous_managed_defaults_skips_stt_when_not_entitled(monkeypatch):
+    """A subscriber whose tool pool doesn't cover openai-audio must not be
+    pointed at a managed gateway that will refuse them."""
+    monkeypatch.setattr(ns, "get_env_value", lambda name: "")
+    monkeypatch.setattr(ns, "resolve_openai_audio_api_key", lambda: "")
+    monkeypatch.setattr(ns, "_local_stt_backend_available", lambda: False)
+    monkeypatch.setattr(
+        ns,
+        "get_nous_subscription_features",
+        lambda config, **kw: _stt_features_stub(
+            account_info=_account(logged_in=True, paid=False)
+        ),
+    )
+
+    config = {"stt": {"provider": "local"}}
+    changed = ns.apply_nous_managed_defaults(config, enabled_toolsets=[])
+
+    assert "stt" not in changed
+    assert config["stt"]["provider"] == "local"
+
+
 def test_apply_nous_managed_defaults_skips_stt_when_groq_key_present(monkeypatch):
     """Don't override a user who explicitly set up Groq for STT."""
     env = {"GROQ_API_KEY": "groq-key"}