feat(M2): UDP voice/media plane -- SFU relay, Opus, AEAD, jitter buffer

Adds the full voice pipeline: 14-byte binary frame header, ChaCha20-Poly1305
AEAD keyed from the TLS exporter, libopus encode/decode with FEC/PLC/DTX,
an adaptive per-ssrc jitter buffer, a miniaudio capture/playback engine, an
APM passthrough stub, and the UdpBinding/StreamAnnounce signaling chain
wired through ConnSession/SessionRegistry into a new server-side SFU
(MediaRelay) that decrypts and re-encrypts frames per channel member.

Exit criterion verified: test_m2_voice — two headless clients relay 50
encrypted Opus frames through the server; ctest --preset m1-dev is 9/9
green. Also corrects protocol.md's UdpBinding diagram, which described the
UDP-side binding packet as AEAD-sealed when it is in fact a plaintext
bootstrap frame (separate from the TCP/TLS UdpBinding ack).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/CMakeLists.txt

@@ -31,6 +31,9 @@ if(VOICECAT_USE_VCPKG_DEPS)
     find_package(asio CONFIG REQUIRED)
     find_package(unofficial-sqlite3 CONFIG REQUIRED)
     find_package(spdlog CONFIG REQUIRED)
+    find_package(Opus CONFIG REQUIRED)
+    # miniaudio is header-only; vcpkg does not install a CMake config for it.
+    find_path(MINIAUDIO_INCLUDE_DIR "miniaudio.h" REQUIRED)
 
     # Generate C++ from voicecat.proto into the build tree.
     protobuf_generate(
@@ -47,7 +50,12 @@ if(VOICECAT_USE_VCPKG_DEPS)
         PUBLIC  protobuf::libprotobuf
         PRIVATE unofficial-sodium::sodium
                 MbedTLS::mbedtls MbedTLS::mbedcrypto MbedTLS::mbedx509
-                asio::asio unofficial::sqlite3::sqlite3 spdlog::spdlog)
+                asio::asio unofficial::sqlite3::sqlite3 spdlog::spdlog
+                Opus::opus)
+
+    target_include_directories(voicecat PRIVATE ${MINIAUDIO_INCLUDE_DIR})
+
+    target_compile_definitions(voicecat PUBLIC VOICECAT_HAS_OPUS VOICECAT_HAS_AUDIO)
 
     if(WIN32)
         # AcceptEx / GetAcceptExSockaddrs live in mswsock; ws2_32 covers the base Winsock API.