feat(M1): TCP/TLS control plane -- auth, channels, ephemeral text

Implements the full M1 milestone. Two clients authenticate over TLS 1.3
(guest + Argon2id password) and exchange channel + private text messages
through a real server. All five ctest --preset m1-dev tests pass in ~1 s.

Key components added:
- vcpkg baseline + m1-dev preset (protobuf/mbedTLS/libsodium/asio/sqlite3)
- FrameCodec feed+emit, encode/decode_envelope, protobuf codegen
- TcpServerConn with blocking TLS handshake thread + tls_read_loop
- TlsContext (mbedTLS 1.3, ECDSA-P256 self-signed cert, TOFU on client)
- WorkerPool (3 threads, used for Argon2id)
- Database: SQLite + libsodium Argon2id, account lifecycle, bootstrap admin
- ServerIdentityManager: Ed25519 key + cert generate/persist/fingerprint
- ConnSession state machine: WaitingHello -> WaitingAuth -> Authenticated
- SessionRegistry: channel tree, user map, text routing, broadcast
- vc_client full M1 C ABI: connect/TLS/handshake/auth/text/disconnect
- voicecat-admin CLI: account add/reset/del/list
- test_m1_integration: M1 exit criterion, verified green

Bug fixed: double-framing in ConnSession::send_envelope -- encode_envelope
was adding the [4-byte len] prefix, then TcpServerConn::send_frame added
a second one, causing the client to parse [len][proto] as protobuf (silent
failure). Fixed by serializing raw protobuf bytes in send_envelope and
letting send_frame apply the single length prefix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/src/session_registry.h

@@ -0,0 +1,84 @@
+/*
+ * server/session_registry.h — In-memory session, channel, and user registry.
+ *
+ * Tracks all authenticated sessions, the channel tree, and user<→>channel assignments.
+ * Protected by a shared_mutex (many readers, few writers). All methods are thread-safe.
+ */
+#ifndef VOICECAT_SERVER_SESSION_REGISTRY_H
+#define VOICECAT_SERVER_SESSION_REGISTRY_H
+
+#ifdef VOICECAT_HAS_NET
+
+#include <cstdint>
+#include <memory>
+#include <shared_mutex>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+#include "proto/voicecat.pb.h"
+
+namespace voicecat::server {
+
+class ConnSession;
+
+struct ChannelEntry {
+    voicecat::v1::Channel proto;
+};
+
+struct UserEntry {
+    voicecat::v1::User proto;
+    uint64_t session_id{};
+};
+
+class SessionRegistry {
+   public:
+    SessionRegistry() = default;
+
+    // Create the default "Lobby" channel (id=1, permanent). Call once at startup.
+    void init_default_channels();
+
+    // Register a session (before auth). Returns the assigned session_id.
+    uint64_t register_session(std::weak_ptr<ConnSession> session);
+
+    // Remove a session (called on disconnect).
+    void unregister_session(uint64_t session_id);
+
+    // Add a user once authenticated. Returns the assigned user_id.
+    uint32_t add_user(uint64_t session_id, const voicecat::v1::User& user);
+
+    // Remove a user (called on disconnect after auth).
+    void remove_user(uint32_t user_id);
+
+    // Move a user to a channel. Returns false if channel doesn't exist.
+    bool set_user_channel(uint32_t user_id, uint32_t channel_id);
+
+    // Snapshot for ServerStateSnapshot message.
+    std::vector<voicecat::v1::Channel> channel_snapshot() const;
+    std::vector<voicecat::v1::User>    user_snapshot() const;
+
+    // Resolve target sessions for a text message relay.
+    // TEXT_CHANNEL: all users in that channel (except sender's session).
+    // TEXT_PRIVATE: the session for that user_id.
+    std::vector<std::shared_ptr<ConnSession>> resolve_text_targets(
+        uint64_t sender_session_id, voicecat::v1::TextScope scope, uint32_t target_id) const;
+
+    // Broadcast an envelope to all sessions except the excluded one.
+    void broadcast(const voicecat::v1::Envelope& env, uint64_t exclude_session_id = 0) const;
+
+   private:
+    mutable std::shared_mutex mu_;
+
+    uint64_t next_session_id_{1};
+    uint32_t next_user_id_{1};
+    uint32_t next_channel_id_{2};  // 1 is reserved for Lobby
+
+    std::unordered_map<uint64_t, std::weak_ptr<ConnSession>> sessions_;
+    std::unordered_map<uint32_t, UserEntry>                   users_;
+    std::unordered_map<uint32_t, ChannelEntry>                channels_;
+};
+
+}  // namespace voicecat::server
+
+#endif  // VOICECAT_HAS_NET
+#endif  // VOICECAT_SERVER_SESSION_REGISTRY_H