M5: moderation, permissions, channel CRUD, in-app account management

- Server-side moderation & permissions (kick/ban/move/server-mute, channel CRUD).

- Database schema v2: channels, bans; BLAKE2b channel passwords, Argon2id accounts.

- C ABI additions and client-side handling (vc_kick_user, vc_ban_user, vc_set_permission, vc_set_server_mute, vc_move_user, vc_create/edit/delete_channel, vc_create/reset/delete/list_account).

- vccli flags for all M5 operations plus --username/--password auth.

- Four new tests covering permissions, kick/ban/move/mute, admin accounts, channel CRUD.

- Docs: protocol.md envelope updates, security.md channel-password hashing, PROGRESS.md.

PROGRESS.md

@@ -10,6 +10,18 @@ up instantly. Newest status at the top.
 
 ## ▶ Where we left off / next action
 
+- **In progress:** **M5 — moderation & admin** (2026-06-17). Server-side and C ABI are
+  implemented and tested: permissions, kick/ban/move/server-mute, channel CRUD, in-app account
+  management. Four new tests pass: `test_m5_permissions`, `test_m5_kick_ban_move_mute`,
+  `test_m5_admin_accounts`, `test_m5_channel_crud`. `vccli` now exposes all M5 operations via
+  CLI flags (`--kick`, `--ban`, `--move`, `--server-mute`/`-unmute`/`-deafen`/`-undeafen`,
+  `--set-permission`, `--create-channel`, `--edit-channel`, `--delete-channel`,
+  `--create-account`, `--reset-password`, `--delete-account`, `--list-accounts`) plus
+  `--username`/`--password` for account auth and `--self-mute`/`--self-deafen`. Docs updated:
+  `docs/protocol.md` (envelope tags for `ServerMuteRequest`/`ListAccountsResult`, `User.server_deafened`,
+  `GenericResult` usage), `docs/security.md` (BLAKE2b channel passwords, `bans` schema).
+  `ctest --preset m1-dev` — **18/18 green**. Still to do: DRED/audio-quality polish and Windows
+  admin/moderation UI.
 - **Done:** **Fixed a *second* silent-playback bug — the playout clock free-ran and drifted off
   the stream** (2026-06-17, reported live: both `vccli` and the Windows client showed `talking=1/0`
   correctly on VAD/PTT, mic + screen-share were recognized by peers, but nothing was audible).
@@ -92,8 +104,8 @@ up instantly. Newest status at the top.
 - [x] **M1 — Control plane** ✓ complete (2026-06-15)
 - [x] **M2 — Voice, single stream** ✓ complete (2026-06-16)
 - [x] **M3 — Multi-stream & per-channel tuning** ✓ complete (2026-06-16)
-- [~] **M4 — Native clients** — Windows WinForms ✓ (2026-06-17); macOS/iOS Swift pending
-- [ ] **M5 — Moderation, polish, beyond** (perms, bans, DRED; then file transfer, E2EE, …)
+- [x] **M4 — Native clients** — Windows WinForms ✓ (2026-06-17); macOS/iOS Swift pending
+- [~] **M5 — Moderation, polish, beyond** (perms, bans, DRED; then file transfer, E2EE, …)
 
 ---
 
@@ -450,6 +462,50 @@ DLLs remain — verified via `objdump -p`).
 
 ---
 
+## M5 — Moderation, polish, and beyond [~] (in progress 2026-06-17)
+
+**Exit criterion:** four ABI-level tests green (`test_m5_permissions`,
+`test_m5_kick_ban_move_mute`, `test_m5_admin_accounts`, `test_m5_channel_crud`);
+`vccli` can drive all moderation/admin/channel operations against a live server.
+
+- [x] **Server-side moderation & permissions:**
+  - `server/src/session_registry.h/.cpp` — per-session `Permissions`, permission helpers
+    (`can_kick`, `can_ban`, etc.), kick/ban/move/server-mute, channel CRUD, DB-backed channel
+    tree load/save, in-memory channel state.
+  - `server/src/conn_session.cpp` — M5 dispatch handlers, permission checks, channel-password
+    + `max_users` enforcement, `UserEvent::UPDATED` broadcast on join/leave.
+  - `core/proto/voicecat.proto` — `ServerMuteRequest`, `UserEvent.reason`, `User.server_deafened`,
+    `ListAccountsResult`, `AccountEntry`.
+- [x] **C ABI / client-side:**
+  - `core/include/voicecat.h` — `vc_permissions`, `vc_channel_info`, `vc_kick_user`,
+    `vc_ban_user`, `vc_set_permission`, `vc_set_server_mute`, `vc_move_user`,
+    `vc_create_channel`, `vc_edit_channel`, `vc_delete_channel`, `vc_create_account`,
+    `vc_reset_password`, `vc_delete_account`, `vc_list_accounts`, `vc_get_permissions`;
+    new events `VC_EVENT_GENERIC_RESULT` and `VC_EVENT_ACCOUNT_LIST`.
+  - `core/src/voicecat.cpp`, `core/src/core/client.h/.cpp` — implementations + server-mute/deafen
+    gating on the client.
+- [x] **Database:** `server/src/db.h/.cpp` schema v2 (`channels`, `bans`), Argon2id accounts,
+  BLAKE2b channel passwords, migrations.
+- [x] **Tests:** four new M5 tests registered in `tests/CMakeLists.txt`:
+  - `test_m5_permissions` — grant/revoke permissions, verify enforcement.
+  - `test_m5_kick_ban_move_mute` — kick, ban, move, server-mute/deafen.
+  - `test_m5_admin_accounts` — create/reset/delete/list accounts.
+  - `test_m5_channel_crud` — create/edit/delete channels, password + max_users enforcement.
+- [x] **vccli** (`tools/vccli/src/main.cpp`) — all M5 operations exposed via flags; account auth
+  via `--username`/`--password`; async `VC_EVENT_GENERIC_RESULT`/`VC_EVENT_ACCOUNT_LIST` handling.
+- [x] **Docs** kept in sync: `docs/protocol.md`, `docs/security.md`, `PROGRESS.md`.
+
+**Key bug fixed:** `test_m5_channel_crud` failed because `SessionRegistry::create_channel`
+broadcast `ChannelEvent::CREATED` from a moved-from `entry.proto` after
+`channels_[id] = std::move(entry)`. Fixed by building the event before moving into the map.
+
+**Still to do:**
+- DRED/audio-quality polish.
+- Windows admin/moderation UI in the WinForms client.
+- macOS/iOS Swift client (carried from M4).
+
+---
+
 ## Decisions log
 
 All architecture/scope decisions are settled and recorded in