Add managed codec DSP and initial control server

dotnet/README.md

@@ -1,10 +1,41 @@
 # VoiceCat .NET rewrite
 
 The first slice targets .NET 10: protobuf, control framing, voice headers, and media
-encryption, TLS 1.3, persisted TOFU pins, and server credentials. Server/client state,
-audio, and UI migration are next. The existing
+encryption, TLS 1.3, persisted TOFU pins, server credentials, and an initial managed
+control server. Media relay, client state, audio, and UI migration are next. The existing
 C++ implementation remains the conformance oracle.
 
+Codec/DSP wrappers now cover Opus, DRED recovery, RNNoise, and energy VAD. Build
+the desktop native library before running their tests (CMake and a C compiler required):
+
+```powershell
+./dotnet/build-native.ps1
+```
+
+The script downloads upstream Opus 1.5.2 with a pinned SHA-256, builds DRED-enabled
+Opus and the existing vendored RNNoise model, and stages `voicecat_media` plus license
+notices under `dotnet/artifacts/native/`. It builds independently of the C++ core and
+vcpkg. On Windows, Visual Studio's C++ workload works with the default generator;
+for this repository's MinGW toolchain use:
+
+```powershell
+./dotnet/build-native.ps1 -Generator Ninja -CCompiler C:/tools/msys64/ucrt64/bin/cc.exe
+```
+
+Linux/macOS can run the same script with PowerShell, or use CMake directly:
+
+```sh
+cmake -S dotnet/native -B dotnet/artifacts/native-build -DCMAKE_BUILD_TYPE=Release
+cmake --build dotnet/artifacts/native-build --target voicecat_media --parallel 2
+cmake --install dotnet/artifacts/native-build --component DotnetMedia --prefix dotnet/artifacts/native
+```
+
+MSBuild copies the staged library into managed build/publish output for the selected
+RID. Override `VoiceCatNativeRid` or `VoiceCatNativeDirectory` for explicit staging;
+`RuntimeIdentifier` takes priority over the SDK's host RID. Cross-compilation is not
+automatic. iOS static linking and audio-device shims belong to later client phases.
+Native codec/DSP tests require this library; they do not silently skip.
+
 From the repository root:
 
 ```powershell
@@ -47,6 +78,16 @@ and 65536. Keys contain bytes 0–31; payload bytes count upward from zero. The
 20-byte header has type 1, marker flag, codec 0, SSRC `0xcafebabe`, timestamp 960.
 Both managed crypto backends must match these bytes.
 
+The DSP oracle calls the existing C++ `ApmProcessor` with 200 deterministic noise
+frames and records the final 960 samples. Regenerate its fixture with:
+
+```powershell
+cmake --build --preset dev --target voicecat-dotnet-dsp-oracle
+./build/dev/bin/voicecat-dotnet-dsp-oracle.exe dotnet/tests/VoiceCat.Tests/Fixtures/cpp-noise.json
+```
+
+The managed test allows a one-unit PCM difference for floating-point rounding.
+
 ## TLS interoperability
 
 The optional TLS oracle uses the existing mbedTLS context and libsodium media crypto.
@@ -65,7 +106,36 @@ managed TLS loopback, rejection, persistence, and wire tests still run. CI's C++
 conformance job requires the native test. See `docs/api-dotnet.md` for ownership
 and certificate acceptance requirements.
 
-## Next checkpoint
+## Managed server checkpoint
 
-Port codec/DSP wrappers and their native packaging per Phase 3 of the porting plan.
-The managed server follows, tested first with the existing C++ CLI.
+Run the TLS control server on loopback (optional arguments: data directory, TCP port):
+
+```powershell
+dotnet run --project dotnet/src/VoiceCat.Server -c Release -- ./voicecat-data 7443
+./build/dev/bin/vccli.exe --host 127.0.0.1 --port 7443 --nick Guest --text "hello"
+```
+
+It creates or imports `server_identity.key`, `server.crt`, `server.key`, and
+`voicecat.db`. An empty channel table gets Lobby and Music Room; existing channels
+are preserved. Guests are enabled by the CLI; hosting `VoiceServer` directly can
+disable them. Existing accounts authenticate without resetting passwords. Account
+creation is currently available through `AccountStore`; bootstrap/admin CLI and
+wire administration are pending.
+
+Tests cover real TLS sockets, authentication retries, snapshots, channel moves,
+text routing, sender attribution, ping, and disconnect events. Enable native checks:
+
+```powershell
+cmake --build --preset dev --target voicecat-dotnet-password-oracle voicecat-dotnet-database-oracle vccli
+$env:VOICECAT_DATABASE_ORACLE = (Resolve-Path build/dev/bin/voicecat-dotnet-database-oracle.exe).Path
+$env:VOICECAT_VCCLI = (Resolve-Path build/dev/bin/vccli.exe).Path
+dotnet test dotnet/VoiceCat.slnx -c Release --no-restore
+```
+
+The database oracle creates an account/channel using the shipped C++ database code;
+managed code imports and authenticates it, then C++ authenticates a managed-created
+account. CI also regenerates the libsodium password fixture. Native checks require
+the optional `VOICECAT_BUILD_DOTNET_ORACLE=ON` configure flag and a real-deps build.
+
+Phase 4 remains in progress: UDP/SFU relay, streams, protected channel joins,
+administration, moderation, and production configuration are the next server work.