feat(M1): TCP/TLS control plane -- auth, channels, ephemeral text

Implements the full M1 milestone. Two clients authenticate over TLS 1.3
(guest + Argon2id password) and exchange channel + private text messages
through a real server. All five ctest --preset m1-dev tests pass in ~1 s.

Key components added:
- vcpkg baseline + m1-dev preset (protobuf/mbedTLS/libsodium/asio/sqlite3)
- FrameCodec feed+emit, encode/decode_envelope, protobuf codegen
- TcpServerConn with blocking TLS handshake thread + tls_read_loop
- TlsContext (mbedTLS 1.3, ECDSA-P256 self-signed cert, TOFU on client)
- WorkerPool (3 threads, used for Argon2id)
- Database: SQLite + libsodium Argon2id, account lifecycle, bootstrap admin
- ServerIdentityManager: Ed25519 key + cert generate/persist/fingerprint
- ConnSession state machine: WaitingHello -> WaitingAuth -> Authenticated
- SessionRegistry: channel tree, user map, text routing, broadcast
- vc_client full M1 C ABI: connect/TLS/handshake/auth/text/disconnect
- voicecat-admin CLI: account add/reset/del/list
- test_m1_integration: M1 exit criterion, verified green

Bug fixed: double-framing in ConnSession::send_envelope -- encode_envelope
was adding the [4-byte len] prefix, then TcpServerConn::send_frame added
a second one, causing the client to parse [len][proto] as protobuf (silent
failure). Fixed by serializing raw protobuf bytes in send_envelope and
letting send_frame apply the single length prefix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CMakePresets.json

@@ -21,6 +21,21 @@
       "toolchainFile": "$env{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake",
       "cacheVariables": { "VOICECAT_USE_VCPKG_DEPS": "ON" }
     },
+    {
+      "name": "m1-dev",
+      "inherits": "vcpkg-base",
+      "displayName": "M1 Dev (TLS control plane, deps via vcpkg)",
+      "description": "Active development preset for M1+. Requires VCPKG_ROOT env var pointing to a bootstrapped vcpkg. Set VCPKG_ROOT=D:\\code\\nvgt\\vcpkg\\bin (or wherever your vcpkg is).",
+      "binaryDir": "${sourceDir}/build/m1-dev",
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Debug",
+        "VOICECAT_USE_VCPKG_DEPS": "ON",
+        "VOICECAT_BUILD_TOOLS": "ON",
+        "VOICECAT_BUILD_TESTS": "ON",
+        "VCPKG_TARGET_TRIPLET": "x64-mingw-static",
+        "VCPKG_HOST_TRIPLET": "x64-mingw-static"
+      }
+    },
     {
       "name": "server-release",
       "inherits": "vcpkg-base",
@@ -28,15 +43,18 @@
       "binaryDir": "${sourceDir}/build/server-release",
       "cacheVariables": {
         "CMAKE_BUILD_TYPE": "Release",
-        "VOICECAT_BUILD_TOOLS": "ON"
+        "VOICECAT_BUILD_TOOLS": "ON",
+        "VCPKG_TARGET_TRIPLET": "x64-mingw-static"
       }
     }
   ],
   "buildPresets": [
     { "name": "dev",            "configurePreset": "dev" },
+    { "name": "m1-dev",         "configurePreset": "m1-dev" },
     { "name": "server-release", "configurePreset": "server-release" }
   ],
   "testPresets": [
-    { "name": "dev", "configurePreset": "dev", "output": { "outputOnFailure": true } }
+    { "name": "dev",    "configurePreset": "dev",    "output": { "outputOnFailure": true } },
+    { "name": "m1-dev", "configurePreset": "m1-dev", "output": { "outputOnFailure": true } }
   ]
 }