M5: moderation, permissions, channel CRUD, in-app account management

- Server-side moderation & permissions (kick/ban/move/server-mute, channel CRUD).

- Database schema v2: channels, bans; BLAKE2b channel passwords, Argon2id accounts.

- C ABI additions and client-side handling (vc_kick_user, vc_ban_user, vc_set_permission, vc_set_server_mute, vc_move_user, vc_create/edit/delete_channel, vc_create/reset/delete/list_account).

- vccli flags for all M5 operations plus --username/--password auth.

- Four new tests covering permissions, kick/ban/move/mute, admin accounts, channel CRUD.

- Docs: protocol.md envelope updates, security.md channel-password hashing, PROGRESS.md.

core/proto/voicecat.proto

@@ -54,12 +54,14 @@ message Envelope {
     KickRequest          kick                   = 60;
     BanRequest           ban                    = 61;
     SetPermissionRequest set_permission         = 62;
+    ServerMuteRequest    server_mute            = 63;
 
     // Admin account management — privileged; accounts are admin-provisioned (70–79)
     CreateAccountRequest create_account         = 70;
     ResetPasswordRequest reset_password         = 71;
     DeleteAccountRequest delete_account         = 72;
     ListAccountsRequest  list_accounts          = 73;
+    ListAccountsResult   list_accounts_result   = 74;
 
     // Future families: file transfer = 100–109. Extension escape hatch = 200+.
     Extension            extension              = 200;
@@ -116,6 +118,7 @@ message User {
   bool   self_deafened = 6;
   bool   server_muted = 7;
   repeated StreamInfo streams = 8;
+  bool   server_deafened = 9;  // M5: server-imposed deafen
 }
 
 message Permissions {
@@ -186,6 +189,7 @@ message UserEvent {
   Kind kind = 1;
   User user = 2;
   uint32 left_id = 3;
+  string reason = 4;  // M5: kick/ban reason for LEFT events
 }
 message SubscribeRequest { repeated uint32 channel_ids = 1; bool presence = 2; }
 
@@ -227,12 +231,15 @@ message TypingIndicator  { TextScope scope = 1; uint32 target_id = 2; uint32 use
 message KickRequest          { uint32 user_id = 1; string reason = 2; }
 message BanRequest           { uint32 user_id = 1; string reason = 2; uint64 expires_unix_ms = 3; }
 message SetPermissionRequest { uint32 user_id = 1; Permissions permissions = 2; }
+message ServerMuteRequest    { uint32 user_id = 1; bool muted = 2; bool deafened = 3; }
 
 // ── Admin account management (privileged) ────────────────────────────────────────
 message CreateAccountRequest { string username = 1; string password = 2; }
 message ResetPasswordRequest { string username = 1; string new_password = 2; }
 message DeleteAccountRequest { string username = 1; }
 message ListAccountsRequest  {}
+message AccountEntry         { string username = 1; bool is_admin = 2; uint64 created_at_unix_ms = 3; uint64 last_login_unix_ms = 4; }
+message ListAccountsResult   { repeated AccountEntry accounts = 1; }
 
 // ── Extension escape hatch ───────────────────────────────────────────────────────
 message Extension { string ns = 1; bytes payload = 2; }