feat(M1): TCP/TLS control plane -- auth, channels, ephemeral text

Implements the full M1 milestone. Two clients authenticate over TLS 1.3
(guest + Argon2id password) and exchange channel + private text messages
through a real server. All five ctest --preset m1-dev tests pass in ~1 s.

Key components added:
- vcpkg baseline + m1-dev preset (protobuf/mbedTLS/libsodium/asio/sqlite3)
- FrameCodec feed+emit, encode/decode_envelope, protobuf codegen
- TcpServerConn with blocking TLS handshake thread + tls_read_loop
- TlsContext (mbedTLS 1.3, ECDSA-P256 self-signed cert, TOFU on client)
- WorkerPool (3 threads, used for Argon2id)
- Database: SQLite + libsodium Argon2id, account lifecycle, bootstrap admin
- ServerIdentityManager: Ed25519 key + cert generate/persist/fingerprint
- ConnSession state machine: WaitingHello -> WaitingAuth -> Authenticated
- SessionRegistry: channel tree, user map, text routing, broadcast
- vc_client full M1 C ABI: connect/TLS/handshake/auth/text/disconnect
- voicecat-admin CLI: account add/reset/del/list
- test_m1_integration: M1 exit criterion, verified green

Bug fixed: double-framing in ConnSession::send_envelope -- encode_envelope
was adding the [4-byte len] prefix, then TcpServerConn::send_frame added
a second one, causing the client to parse [len][proto] as protobuf (silent
failure). Fixed by serializing raw protobuf bytes in send_envelope and
letting send_frame apply the single length prefix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/src/protocol/protocol.cpp

@@ -1,11 +1,60 @@
 #include "protocol/protocol.h"
 
+#include <cstring>
+
 namespace voicecat::protocol {
 
-// M0 stub. The frame codec + protobuf Envelope dispatch are the first M1 task
-// (AGENTS.md "Suggested first steps" #1). See docs/protocol.md §1–5.
-bool FrameCodec::feed(const uint8_t*, size_t, std::vector<std::vector<uint8_t>>&) {
-    return true;  // TODO(M1): real framing.
+// --- FrameCodec::emit -------------------------------------------------------
+
+void FrameCodec::emit(const uint8_t* payload, size_t len, std::vector<uint8_t>& out) {
+    // Length header: big-endian u32.
+    auto u32 = static_cast<uint32_t>(len);
+    out.push_back(static_cast<uint8_t>((u32 >> 24) & 0xFF));
+    out.push_back(static_cast<uint8_t>((u32 >> 16) & 0xFF));
+    out.push_back(static_cast<uint8_t>((u32 >>  8) & 0xFF));
+    out.push_back(static_cast<uint8_t>( u32         & 0xFF));
+    out.insert(out.end(), payload, payload + len);
+}
+
+void FrameCodec::emit(const std::vector<uint8_t>& payload, std::vector<uint8_t>& out) {
+    emit(payload.data(), payload.size(), out);
+}
+
+// --- FrameCodec::feed -------------------------------------------------------
+
+bool FrameCodec::feed(const uint8_t* data, size_t len,
+                      std::vector<std::vector<uint8_t>>& out_frames) {
+    buf_.insert(buf_.end(), data, data + len);
+
+    while (true) {
+        if (buf_.size() < kLengthHeaderSize) {
+            break;  // need more bytes for the header
+        }
+
+        // Decode big-endian u32 length.
+        uint32_t frame_len =
+            (static_cast<uint32_t>(buf_[0]) << 24) |
+            (static_cast<uint32_t>(buf_[1]) << 16) |
+            (static_cast<uint32_t>(buf_[2]) <<  8) |
+             static_cast<uint32_t>(buf_[3]);
+
+        if (frame_len > kMaxFrameBytes) {
+            buf_.clear();
+            return false;  // oversized frame — protocol error
+        }
+
+        size_t total = kLengthHeaderSize + static_cast<size_t>(frame_len);
+        if (buf_.size() < total) {
+            break;  // need more bytes for the body
+        }
+
+        // Extract the complete frame payload.
+        out_frames.emplace_back(buf_.begin() + kLengthHeaderSize,
+                                buf_.begin() + total);
+        buf_.erase(buf_.begin(), buf_.begin() + total);
+    }
+
+    return true;
 }
 
 }  // namespace voicecat::protocol