feat(M1): TCP/TLS control plane -- auth, channels, ephemeral text

Implements the full M1 milestone. Two clients authenticate over TLS 1.3
(guest + Argon2id password) and exchange channel + private text messages
through a real server. All five ctest --preset m1-dev tests pass in ~1 s.

Key components added:
- vcpkg baseline + m1-dev preset (protobuf/mbedTLS/libsodium/asio/sqlite3)
- FrameCodec feed+emit, encode/decode_envelope, protobuf codegen
- TcpServerConn with blocking TLS handshake thread + tls_read_loop
- TlsContext (mbedTLS 1.3, ECDSA-P256 self-signed cert, TOFU on client)
- WorkerPool (3 threads, used for Argon2id)
- Database: SQLite + libsodium Argon2id, account lifecycle, bootstrap admin
- ServerIdentityManager: Ed25519 key + cert generate/persist/fingerprint
- ConnSession state machine: WaitingHello -> WaitingAuth -> Authenticated
- SessionRegistry: channel tree, user map, text routing, broadcast
- vc_client full M1 C ABI: connect/TLS/handshake/auth/text/disconnect
- voicecat-admin CLI: account add/reset/del/list
- test_m1_integration: M1 exit criterion, verified green

Bug fixed: double-framing in ConnSession::send_envelope -- encode_envelope
was adding the [4-byte len] prefix, then TcpServerConn::send_frame added
a second one, causing the client to parse [len][proto] as protobuf (silent
failure). Fixed by serializing raw protobuf bytes in send_envelope and
letting send_frame apply the single length prefix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/src/session_registry.cpp

@@ -0,0 +1,115 @@
+#include "session_registry.h"
+
+#ifdef VOICECAT_HAS_NET
+
+#include <mutex>
+#include <shared_mutex>
+
+#include "conn_session.h"
+
+namespace voicecat::server {
+
+void SessionRegistry::init_default_channels() {
+    std::unique_lock lk(mu_);
+    ChannelEntry lobby;
+    lobby.proto.set_id(1);
+    lobby.proto.set_name("Lobby");
+    lobby.proto.set_type(voicecat::v1::CHANNEL_PERMANENT);
+    lobby.proto.set_order(0);
+    channels_[1] = std::move(lobby);
+}
+
+uint64_t SessionRegistry::register_session(std::weak_ptr<ConnSession> session) {
+    std::unique_lock lk(mu_);
+    uint64_t id = next_session_id_++;
+    sessions_[id] = std::move(session);
+    return id;
+}
+
+void SessionRegistry::unregister_session(uint64_t session_id) {
+    std::unique_lock lk(mu_);
+    sessions_.erase(session_id);
+}
+
+uint32_t SessionRegistry::add_user(uint64_t session_id, const voicecat::v1::User& user) {
+    std::unique_lock lk(mu_);
+    uint32_t uid = next_user_id_++;
+    UserEntry entry;
+    entry.proto = user;
+    entry.proto.set_id(uid);
+    entry.proto.set_channel_id(1);  // start in Lobby
+    entry.session_id = session_id;
+    users_[uid] = std::move(entry);
+    return uid;
+}
+
+void SessionRegistry::remove_user(uint32_t user_id) {
+    std::unique_lock lk(mu_);
+    users_.erase(user_id);
+}
+
+bool SessionRegistry::set_user_channel(uint32_t user_id, uint32_t channel_id) {
+    std::unique_lock lk(mu_);
+    auto ch_it = channels_.find(channel_id);
+    if (ch_it == channels_.end()) return false;
+    auto user_it = users_.find(user_id);
+    if (user_it == users_.end()) return false;
+    user_it->second.proto.set_channel_id(channel_id);
+    return true;
+}
+
+std::vector<voicecat::v1::Channel> SessionRegistry::channel_snapshot() const {
+    std::shared_lock lk(mu_);
+    std::vector<voicecat::v1::Channel> result;
+    result.reserve(channels_.size());
+    for (auto& [id, entry] : channels_) result.push_back(entry.proto);
+    return result;
+}
+
+std::vector<voicecat::v1::User> SessionRegistry::user_snapshot() const {
+    std::shared_lock lk(mu_);
+    std::vector<voicecat::v1::User> result;
+    result.reserve(users_.size());
+    for (auto& [id, entry] : users_) result.push_back(entry.proto);
+    return result;
+}
+
+std::vector<std::shared_ptr<ConnSession>> SessionRegistry::resolve_text_targets(
+    uint64_t sender_session_id, voicecat::v1::TextScope scope, uint32_t target_id) const {
+    std::shared_lock lk(mu_);
+    std::vector<std::shared_ptr<ConnSession>> targets;
+
+    if (scope == voicecat::v1::TEXT_CHANNEL) {
+        // Find channel_id of the target, then all users in that channel
+        for (auto& [uid, entry] : users_) {
+            if (entry.proto.channel_id() != target_id) continue;
+            if (entry.session_id == sender_session_id) continue;
+            auto sit = sessions_.find(entry.session_id);
+            if (sit == sessions_.end()) continue;
+            if (auto sess = sit->second.lock()) targets.push_back(sess);
+        }
+    } else if (scope == voicecat::v1::TEXT_PRIVATE) {
+        // target_id is user_id
+        auto user_it = users_.find(target_id);
+        if (user_it != users_.end()) {
+            auto sit = sessions_.find(user_it->second.session_id);
+            if (sit != sessions_.end()) {
+                if (auto sess = sit->second.lock()) targets.push_back(sess);
+            }
+        }
+    }
+    return targets;
+}
+
+void SessionRegistry::broadcast(const voicecat::v1::Envelope& env,
+                                 uint64_t exclude_session_id) const {
+    std::shared_lock lk(mu_);
+    for (auto& [sid, weak] : sessions_) {
+        if (sid == exclude_session_id) continue;
+        if (auto sess = weak.lock()) sess->send_envelope(env);
+    }
+}
+
+}  // namespace voicecat::server
+
+#endif  // VOICECAT_HAS_NET