inputs.audio() mishandles data: URIs (mislabels/garbage format) #2

Severity: Medium — inputs.audio() mishandles data: URIs

audio() derives format from the file extension only, and (unlike image()/file()) skips both the data-URL MIME lookup and the blacklist check.

Reproduced

audio("https://x.com/a.mp3")            -> format "mp3"                              (ok)
audio("data:audio/mpeg;base64,...")     -> JS:  format "data:audio/mpeg;base64,..."  (garbage)
                                           Py:  format "wav"                          (mislabels every data-URL)

autoPart/auto_part inherit this (they don't pass the MIME they already computed).

The server then sets the audio mediaType from this format (src/helpers/message.ts:321-338): JS produces a nonsense media type; Python labels an mp3 as audio/wav.

Fix

In audio(): use the data-URL MIME when present (strip to the subtype for format), run the same assertAllowed check as the other builders, and have autoPart/auto_part forward the already-detected format.