feat(M1): TCP/TLS control plane -- auth, channels, ephemeral text

Implements the full M1 milestone. Two clients authenticate over TLS 1.3
(guest + Argon2id password) and exchange channel + private text messages
through a real server. All five ctest --preset m1-dev tests pass in ~1 s.

Key components added:
- vcpkg baseline + m1-dev preset (protobuf/mbedTLS/libsodium/asio/sqlite3)
- FrameCodec feed+emit, encode/decode_envelope, protobuf codegen
- TcpServerConn with blocking TLS handshake thread + tls_read_loop
- TlsContext (mbedTLS 1.3, ECDSA-P256 self-signed cert, TOFU on client)
- WorkerPool (3 threads, used for Argon2id)
- Database: SQLite + libsodium Argon2id, account lifecycle, bootstrap admin
- ServerIdentityManager: Ed25519 key + cert generate/persist/fingerprint
- ConnSession state machine: WaitingHello -> WaitingAuth -> Authenticated
- SessionRegistry: channel tree, user map, text routing, broadcast
- vc_client full M1 C ABI: connect/TLS/handshake/auth/text/disconnect
- voicecat-admin CLI: account add/reset/del/list
- test_m1_integration: M1 exit criterion, verified green

Bug fixed: double-framing in ConnSession::send_envelope -- encode_envelope
was adding the [4-byte len] prefix, then TcpServerConn::send_frame added
a second one, causing the client to parse [len][proto] as protobuf (silent
failure). Fixed by serializing raw protobuf bytes in send_envelope and
letting send_frame apply the single length prefix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/src/protocol/protocol.h

@@ -17,15 +17,28 @@
 
 namespace voicecat::protocol {
 
-constexpr uint32_t kProtocolVersion = 1;          // docs/protocol.md §4
-constexpr uint32_t kMaxFrameBytes = 16u * 1024 * 1024;  // §1 oversized-frame guard
+constexpr uint32_t kProtocolVersion  = 1;
+constexpr uint32_t kMaxFrameBytes    = 16u * 1024 * 1024;  // docs/protocol.md §1 guard
+constexpr size_t   kLengthHeaderSize = 4;                   // big-endian u32 prefix
 
-// Reads/writes [u32 length][payload] frames from a byte stream. TODO(M1).
+// Reads/writes [u32 big-endian length][payload] frames from a byte stream.
 class FrameCodec {
    public:
-    // Append received bytes; pop complete frame payloads. Returns false on protocol error
-    // (e.g. length > kMaxFrameBytes).
+    // Append received bytes; pop complete frame payloads into out_frames.
+    // Returns false on protocol error (oversized frame or framing violation).
     bool feed(const uint8_t* data, size_t len, std::vector<std::vector<uint8_t>>& out_frames);
+
+    // Serialize a frame into out: [big-endian u32 length][payload bytes].
+    static void emit(const uint8_t* payload, size_t len, std::vector<uint8_t>& out);
+    static void emit(const std::vector<uint8_t>& payload, std::vector<uint8_t>& out);
+
+    // Number of bytes buffered but not yet forming a complete frame.
+    size_t pending_bytes() const { return buf_.size(); }
+
+    void reset() { buf_.clear(); }
+
+   private:
+    std::vector<uint8_t> buf_;
 };
 
 }  // namespace voicecat::protocol