M5: moderation, permissions, channel CRUD, in-app account management

- Server-side moderation & permissions (kick/ban/move/server-mute, channel CRUD).

- Database schema v2: channels, bans; BLAKE2b channel passwords, Argon2id accounts.

- C ABI additions and client-side handling (vc_kick_user, vc_ban_user, vc_set_permission, vc_set_server_mute, vc_move_user, vc_create/edit/delete_channel, vc_create/reset/delete/list_account).

- vccli flags for all M5 operations plus --username/--password auth.

- Four new tests covering permissions, kick/ban/move/mute, admin accounts, channel CRUD.

- Docs: protocol.md envelope updates, security.md channel-password hashing, PROGRESS.md.

core/src/core/client.h

@@ -77,6 +77,21 @@ struct vc_client {
     // TEST-ONLY (see voicecat.h) — inject synthetic PCM into a local stream's encode pipeline.
     vc_result test_inject_capture(uint32_t stream_id, const int16_t* pcm, size_t samples);
 
+    // M5: moderation & admin.
+    vc_result kick_user(uint32_t user_id, const char* reason);
+    vc_result ban_user(uint32_t user_id, const char* reason, uint64_t expires_unix_ms);
+    vc_result set_permission(uint32_t user_id, const vc_permissions* perms);
+    vc_result set_server_mute(uint32_t user_id, bool muted, bool deafened);
+    vc_result move_user(uint32_t user_id, uint32_t channel_id);
+    vc_result create_channel(const vc_channel_info* info);
+    vc_result edit_channel(const vc_channel_info* info);
+    vc_result delete_channel(uint32_t channel_id);
+    vc_result create_account(const char* username, const char* password);
+    vc_result reset_password(const char* username, const char* new_password);
+    vc_result delete_account(const char* username);
+    vc_result list_accounts();
+    vc_result get_permissions(vc_permissions* out);
+
     vc_connection_state state() const {
 #ifdef VOICECAT_HAS_NET
         return state_net_.load(std::memory_order_acquire);
@@ -202,6 +217,11 @@ struct vc_client {
 
     std::atomic<bool> self_mic_muted_{false};
     std::atomic<bool> self_deafened_{false};
+    std::atomic<bool> server_muted_{false};
+    std::atomic<bool> server_deafened_{false};
+
+    // M5: permissions from last AuthResult.
+    vc_permissions own_permissions_{};
 
     // Follow-up to M3: send-side input gate (docs/voice.md §11). MIC-only — SCREEN_AUDIO/
     // AUX_DEVICE are never gated (see PROGRESS.md for the rationale). Pure local state, no