feat(M2): UDP voice/media plane -- SFU relay, Opus, AEAD, jitter buffer

Adds the full voice pipeline: 14-byte binary frame header, ChaCha20-Poly1305
AEAD keyed from the TLS exporter, libopus encode/decode with FEC/PLC/DTX,
an adaptive per-ssrc jitter buffer, a miniaudio capture/playback engine, an
APM passthrough stub, and the UdpBinding/StreamAnnounce signaling chain
wired through ConnSession/SessionRegistry into a new server-side SFU
(MediaRelay) that decrypts and re-encrypts frames per channel member.

Exit criterion verified: test_m2_voice — two headless clients relay 50
encrypted Opus frames through the server; ctest --preset m1-dev is 9/9
green. Also corrects protocol.md's UdpBinding diagram, which described the
UDP-side binding packet as AEAD-sealed when it is in fact a plaintext
bootstrap frame (separate from the TCP/TLS UdpBinding ack).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/src/audio/apm_processor.cpp

@@ -0,0 +1,21 @@
+#include "audio/apm_processor.h"
+
+namespace voicecat::audio {
+
+// ── ApmPassthrough ────────────────────────────────────────────────────────────
+// No-op: returns true (VAD always open), does not modify PCM.
+// Replaced by WebrtcApmProcessor when VOICECAT_HAS_APM is defined.
+class ApmPassthrough final : public ApmProcessor {
+   public:
+    void process_render(const int16_t*, int, int) override {}
+    bool process_capture(int16_t*, int, int) override { return true; }
+};
+
+std::unique_ptr<ApmProcessor> ApmProcessor::create() {
+#ifdef VOICECAT_HAS_APM
+    // TODO(M3): return std::make_unique<WebrtcApmProcessor>();
+#endif
+    return std::make_unique<ApmPassthrough>();
+}
+
+}  // namespace voicecat::audio