host: cross-platform audio decode (Android has sound)

Replace the macOS-only AudioToolbox decoder with mt_host::decode_audio: a
RIFF/WAVE PCM parser plus vendored dr_mp3, resampled/remixed to 44.1 kHz
stereo float with SDL_ConvertAudioSamples. macOS and Android now share one
path; the AudioToolbox link is gone.

BGM is no longer cached in clips_ (a 5-minute track is ~100 MB of float):
only the playing track is kept, and a new one decodes on a worker thread
(the pack read stays on the main thread) so map changes do not stall.

host.audio_decode test: synthetic wav layouts + all 1578 pack .wav, 9 pack
.mp3 and 25 Client/BGM .mp3 decode (7060 s of audio in ~3.6 s on M2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/PORT-PLAN.md

@@ -67,6 +67,7 @@ src/host/live_client.cpp                     # run_live_client：40250 客户端
 src/host/vulkan_window.cpp                   # SDL 窗口/事件 + Vulkan 渲染器（回放 Render3DDraw / UIRenderCommand）
 src/host/frame_policy.cpp                    # 帧率策略（FrameRatePolicy）
 src/host/native_audio.cpp                    # MilesLib AudioCommand → SDL 音频流
+src/host/audio_decode.cpp                    # .wav（手写 PCM 解析）/.mp3（dr_mp3）→ 44.1 kHz 立体声 float，全平台同一路径
 src/host/android_perf.h                      # Android 帧率、ADPF、电量/温度（JNI 到 MainActivity）
 android/                                     # Gradle 工程：SDLActivity 外壳 MainActivity、APK 打包
 ```

docs/THIRD-PARTY.md

@@ -125,6 +125,19 @@ with those layers.
   the shipped product's documentation must credit "Portions of this software are
   copyright © The FreeType Project (www.freetype.org)".
 
+## Host single-header libraries (`src/host/third_party/`)
+
+Only the native host (`src/host`) includes these; each has one implementation TU.
+
+* **stb_image v2.30** (`stb_image.h`, implemented in `stb_image_impl.cpp`): TGA/PNG/JPG
+  UI and texture decode. Public domain or MIT.
+* **dr_mp3 v0.7.4** (`dr_mp3.h`, implemented in `audio_decode.cpp` with
+  `DR_MP3_NO_STDIO`): the `.mp3` half of `mt_host::decode_audio` (pack sounds and
+  `Client/BGM`), replacing the macOS-only AudioToolbox decoder so Android has audio.
+  Fetched 2026-09-29 from `https://cdn.jsdelivr.net/gh/mackron/dr_libs@master/dr_mp3.h`,
+  sha256 `997b7ee18de6e6b81e2a83f1ea9fc62aef25c62b28d48db95635f49e65de0a2f`.
+  Public domain (Unlicense) or MIT-0; no attribution required.
+
 ## Rebuilding / fetching
 
 There are no submodules: miniLZO, Crypto++, CPython and FreeType are vendored