Add managed server profiles and account login

docs/api-dotnet.md

@@ -96,6 +96,18 @@ Only explicit `Pin` or `Remove` changes the file. Pin replacement requires an
 explicit caller decision; malformed files fail closed. Changes replace the file
 atomically before updating memory. Use one owner per store/file.
 
+`ServerProfile` is the app-facing saved-server model shared by platform clients. Construct
+profiles with `ServerProfile.Create`, which trims values and requires a host, nonzero port,
+and username for account authentication. A profile contains only its stable ID, endpoint,
+authentication mode, username or guest nickname. It deliberately has no password field.
+Platform clients own any secret storage, such as macOS Keychain integration.
+
+`ServerProfileStore` serializes profiles as camel-case JSON with string authentication
+values. Missing, malformed and unreadable files load as an empty list; invalid individual
+profiles are discarded. Saving filters invalid entries and replaces the file through a
+same-directory temporary file. Use one owner per store/file and do not treat it as a
+credential store.
+
 `ServerIdentity` reads and writes the native 96-byte Ed25519 format:
 `public-key[32] || seed[32] || public-key[32]`. Loading verifies both public-key
 copies against the seed. Disposal clears the owned seed.

docs/porting-to-dotnet.md

@@ -851,7 +851,8 @@ Per §8.2. AppKit port, ScreenCaptureKit per-app audio selection, VoiceOver pari
 build produced.
 
 **Checkpoint (2026-09-16):** `clients/apple/dotnet/VoiceCat.Mac` is a separate .NET 10
-AppKit application that consumes `VoiceCat.Core` directly. It implements guest connection,
+AppKit application that consumes `VoiceCat.Core` directly. It implements guest and account
+connection, validated saved server profiles whose JSON never contains passwords,
 interactive TOFU approval, channel browsing, roster/chat, voice subscription, native
 accessibility labels and default-device microphone/playback. Core Audio capture is resampled
 and converted through `AVAudioConverter` before entering the managed audio engine. Stereo
@@ -860,9 +861,9 @@ not allocate, lock or block. Voice stream lifetime follows subscription, disconn
 channel changes. Current Apple API calls compile warning-free against Microsoft's
 26.4.10259 macOS reference assembly, and a macOS CI job builds the native codec/DSP shim and
 Apple solution. A real macOS device run and listen test remain required. The existing Swift
-app remains the release client until saved servers/accounts, selectable devices, the rest of
-the moderation/settings surface, ScreenCaptureKit, VoiceOver validation, signing and
-notarization are complete.
+app remains the release client until protected-channel prompts, optional Keychain credentials,
+selectable devices, the rest of the moderation/settings surface, ScreenCaptureKit, VoiceOver
+validation, signing and notarization are complete.
 
 ---