feat(M1): TCP/TLS control plane -- auth, channels, ephemeral text

Implements the full M1 milestone. Two clients authenticate over TLS 1.3
(guest + Argon2id password) and exchange channel + private text messages
through a real server. All five ctest --preset m1-dev tests pass in ~1 s.

Key components added:
- vcpkg baseline + m1-dev preset (protobuf/mbedTLS/libsodium/asio/sqlite3)
- FrameCodec feed+emit, encode/decode_envelope, protobuf codegen
- TcpServerConn with blocking TLS handshake thread + tls_read_loop
- TlsContext (mbedTLS 1.3, ECDSA-P256 self-signed cert, TOFU on client)
- WorkerPool (3 threads, used for Argon2id)
- Database: SQLite + libsodium Argon2id, account lifecycle, bootstrap admin
- ServerIdentityManager: Ed25519 key + cert generate/persist/fingerprint
- ConnSession state machine: WaitingHello -> WaitingAuth -> Authenticated
- SessionRegistry: channel tree, user map, text routing, broadcast
- vc_client full M1 C ABI: connect/TLS/handshake/auth/text/disconnect
- voicecat-admin CLI: account add/reset/del/list
- test_m1_integration: M1 exit criterion, verified green

Bug fixed: double-framing in ConnSession::send_envelope -- encode_envelope
was adding the [4-byte len] prefix, then TcpServerConn::send_frame added
a second one, causing the client to parse [len][proto] as protobuf (silent
failure). Fixed by serializing raw protobuf bytes in send_envelope and
letting send_frame apply the single length prefix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/src/conn_session.h

@@ -0,0 +1,101 @@
+/*
+ * server/conn_session.h — Per-client connection state machine.
+ *
+ * State: WaitingHello → WaitingAuth → Authenticated → Disconnecting
+ *
+ * Design: ConnSession is a pure state machine. It receives frames via on_frame()
+ * (called from TcpServerConn's strand) and sends via a send_fn set after construction.
+ * The server creates the TcpServerConn first (with callbacks referencing the session),
+ * then calls set_tcp() to give the session its send capability.
+ */
+#ifndef VOICECAT_SERVER_CONN_SESSION_H
+#define VOICECAT_SERVER_CONN_SESSION_H
+
+#ifdef VOICECAT_HAS_NET
+
+#include <array>
+#include <atomic>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "proto/voicecat.pb.h"
+
+namespace voicecat { class WorkerPool; }  // defined in core/worker_pool.h
+
+namespace voicecat::server {
+
+class Database;
+class SessionRegistry;
+
+class ConnSession : public std::enable_shared_from_this<ConnSession> {
+   public:
+    enum class State { WaitingHello, WaitingAuth, Authenticated, Disconnecting };
+
+    using SendFn = std::function<void(std::vector<uint8_t>)>;
+    using CloseFn = std::function<void()>;
+
+    ConnSession(std::shared_ptr<Database>               db,
+                std::shared_ptr<SessionRegistry>          registry,
+                std::shared_ptr<voicecat::WorkerPool>     workers,
+                const std::array<uint8_t, 32>&   server_fp,
+                bool                              allow_guests);
+
+    // Called after construction: gives the session its send + close handles.
+    void set_io(SendFn send_fn, CloseFn close_fn);
+
+    // Called by server after it has registered the session id.
+    void set_session_id(uint64_t id) { session_id_ = id; }
+
+    // Entry point: send ServerHello and begin reading.
+    void begin();
+
+    // Deliver a received frame (called from TcpServerConn's strand).
+    void on_frame(std::vector<uint8_t> frame);
+
+    // Called when the TCP connection drops.
+    void on_disconnect();
+
+    // Thread-safe send.
+    void send_envelope(const voicecat::v1::Envelope& env);
+
+    // Graceful close (can be called from any thread).
+    void close();
+
+    State    state()      const { return state_.load(); }
+    uint64_t session_id() const { return session_id_; }
+    uint32_t user_id()    const { return user_id_; }
+
+   private:
+    void handle_client_hello(uint64_t req_id, const voicecat::v1::ClientHello& msg);
+    void handle_auth_request(uint64_t req_id, const voicecat::v1::AuthRequest& msg);
+    void handle_join_channel(uint64_t req_id, const voicecat::v1::JoinChannelRequest& msg);
+    void handle_text_message(const voicecat::v1::TextMessage& msg);
+    void handle_ping(const voicecat::v1::Ping& msg);
+    void finish_guest_auth(const voicecat::v1::GuestAuth& guest, uint64_t req_id);
+    void finish_password_auth(const std::string& username, const std::string& password,
+                              uint64_t req_id);
+    void send_state_snapshot();
+    void broadcast_user_joined(const voicecat::v1::User& user);
+    void send_disconnect_and_close(uint32_t code, const std::string& reason);
+
+    std::shared_ptr<Database>        db_;
+    std::shared_ptr<SessionRegistry> registry_;
+    std::shared_ptr<voicecat::WorkerPool> workers_;
+    std::array<uint8_t, 32>          server_fp_;
+    bool                             allow_guests_;
+
+    SendFn                    send_fn_;
+    CloseFn                   close_fn_;
+    std::atomic<State>        state_{State::WaitingHello};
+    uint64_t                  session_id_{0};   // set once before begin(), then read-only
+    std::atomic<uint32_t>     user_id_{0};
+    std::atomic<bool>         closed_{false};
+};
+
+}  // namespace voicecat::server
+
+#endif  // VOICECAT_HAS_NET
+#endif  // VOICECAT_SERVER_CONN_SESSION_H