fix(linux-aec): fall back to 0.3 crate + apt lib (2.x bundled is broken)

Switch the webrtc-audio-processing dep from the 2.x git source (bundled
mode) back to crates.io 0.3, and link against Debian's apt package
libwebrtc-audio-processing-dev (0.3-1+b1 on Bookworm). The 2.x path
fails because both the crates.io tarball and the upstream git main
branch of webrtc-audio-processing-sys 2.0.3 have a build.rs bug where
\`meson setup --reconfigure\` is passed unconditionally, panicking on
first-run empty build dirs with "Directory does not contain a valid
build tree". The 0.x line sidesteps bundled mode entirely by linking
the apt-provided library.

Trade-off: we get AEC2 (the older generation) instead of AEC3, but
it's the same algorithm family and is what PulseAudio's
module-echo-cancel and PipeWire's filter-chain use on current
Debian-family distros. Fine for shipping — we can revisit AEC3 once
the 2.x bundled build is fixed upstream.

API changes:
- 0.3's Processor::process_capture_frame and process_render_frame
  take &mut self, so wrap the module-level processor in a Mutex.
  Capture and playback threads each lock briefly (sub-ms per 10 ms
  frame); contention is minimal.
- Import NUM_SAMPLES_PER_FRAME from the crate directly instead of
  hardcoding 480, so the code tracks whatever sample rate the
  upstream C++ lib exposes (currently 48 kHz hardcoded -> 480).
- Helper fns drain_frames_through_apm / tee_render_samples / etc.
  take &Mutex<Processor> instead of &Processor.
- Use explicit EchoCancellationSuppressionLevel and
  NoiseSuppressionLevel imports rather than fully-qualified paths.

Dockerfile:
- Drop meson / ninja-build / python3 (only needed for bundled build).
- Add libwebrtc-audio-processing-dev for the system link path.
- Keep clang (may be needed by the bindgen step in some versions).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/Dockerfile.linux-desktop-builder

@@ -33,22 +33,27 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         librsvg2-dev \
         libglib2.0-dev \
         patchelf \
-        meson \
-        ninja-build \
-        python3 \
+        libwebrtc-audio-processing-dev \
         clang \
     && rm -rf /var/lib/apt/lists/*
 
 # ── webrtc-audio-processing build requirements ──────────────────────────────
-# The `webrtc-audio-processing` Rust crate with the `bundled` feature vendors
-# the PulseAudio webrtc-audio-processing C++ library and builds it via meson
-# + ninja at `cargo build` time. That avoids Debian Bookworm's stale
-# libwebrtc-audio-processing-dev 0.3-1 package (which predates AEC3) and gives
-# us a self-contained static link — no runtime .so dependency, same algorithm
-# on every Linux distro regardless of what apt ships.
+# The `webrtc-audio-processing` Rust crate (0.3.x line) links against Debian
+# Bookworm's `libwebrtc-audio-processing-dev` apt package (0.3-1+b1), which
+# provides the PulseAudio fork of the WebRTC audio processing module. This is
+# the library that Pulse's module-echo-cancel and PipeWire's filter-chain
+# use for their AEC modes — same algorithm family, runtime-linked via
+# pkg-config at cargo build time.
 #
-# apt deps for the bundled build: meson, ninja-build, python3, clang,
-# build-essential (already present via android-builder base).
+# An attempt was made to use the 2.x line with the `bundled` sub-feature
+# (which would give AEC3 instead of AEC2) but both the crates.io tarball
+# and the upstream git `main` branch hit a `meson setup --reconfigure` bug
+# that panics on first-run empty build dirs. The 0.3 line avoids the
+# bundled build path entirely and is what we ship for now.
+#
+# `clang` is listed explicitly because the Rust crate's bindgen may need
+# it at compile time depending on the version of the underlying
+# webrtc-audio-processing-sys build script.
 
 USER builder
 WORKDIR /build/source