host: cross-platform audio decode (Android has sound)

Replace the macOS-only AudioToolbox decoder with mt_host::decode_audio: a
RIFF/WAVE PCM parser plus vendored dr_mp3, resampled/remixed to 44.1 kHz
stereo float with SDL_ConvertAudioSamples. macOS and Android now share one
path; the AudioToolbox link is gone.

BGM is no longer cached in clips_ (a 5-minute track is ~100 MB of float):
only the playing track is kept, and a new one decodes on a worker thread
(the pack read stays on the main thread) so map changes do not stall.

host.audio_decode test: synthetic wav layouts + all 1578 pack .wav, 9 pack
.mp3 and 25 Client/BGM .mp3 decode (7060 s of audio in ~3.6 s on M2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/THIRD-PARTY.md

@@ -125,6 +125,19 @@ with those layers.
   the shipped product's documentation must credit "Portions of this software are
   copyright © The FreeType Project (www.freetype.org)".
 
+## Host single-header libraries (`src/host/third_party/`)
+
+Only the native host (`src/host`) includes these; each has one implementation TU.
+
+* **stb_image v2.30** (`stb_image.h`, implemented in `stb_image_impl.cpp`): TGA/PNG/JPG
+  UI and texture decode. Public domain or MIT.
+* **dr_mp3 v0.7.4** (`dr_mp3.h`, implemented in `audio_decode.cpp` with
+  `DR_MP3_NO_STDIO`): the `.mp3` half of `mt_host::decode_audio` (pack sounds and
+  `Client/BGM`), replacing the macOS-only AudioToolbox decoder so Android has audio.
+  Fetched 2026-09-29 from `https://cdn.jsdelivr.net/gh/mackron/dr_libs@master/dr_mp3.h`,
+  sha256 `997b7ee18de6e6b81e2a83f1ea9fc62aef25c62b28d48db95635f49e65de0a2f`.
+  Public domain (Unlicense) or MIT-0; no attribution required.
+
 ## Rebuilding / fetching
 
 There are no submodules: miniLZO, Crypto++, CPython and FreeType are vendored