feat(M2): UDP voice/media plane -- SFU relay, Opus, AEAD, jitter buffer

Adds the full voice pipeline: 14-byte binary frame header, ChaCha20-Poly1305
AEAD keyed from the TLS exporter, libopus encode/decode with FEC/PLC/DTX,
an adaptive per-ssrc jitter buffer, a miniaudio capture/playback engine, an
APM passthrough stub, and the UdpBinding/StreamAnnounce signaling chain
wired through ConnSession/SessionRegistry into a new server-side SFU
(MediaRelay) that decrypts and re-encrypts frames per channel member.

Exit criterion verified: test_m2_voice — two headless clients relay 50
encrypted Opus frames through the server; ctest --preset m1-dev is 9/9
green. Also corrects protocol.md's UdpBinding diagram, which described the
UDP-side binding packet as AEAD-sealed when it is in fact a plaintext
bootstrap frame (separate from the TCP/TLS UdpBinding ack).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/src/audio/apm_processor.h

@@ -0,0 +1,33 @@
+/*
+ * audio/apm_processor.h — Send-side audio processing module (AEC/NS/AGC/VAD).
+ *
+ * Design: docs/voice.md §11. Uses webrtc-audio-processing when VOICECAT_HAS_APM is defined;
+ * falls back to a no-op passthrough (VAD always open, PCM unmodified) otherwise.
+ */
+#ifndef VOICECAT_AUDIO_APM_PROCESSOR_H
+#define VOICECAT_AUDIO_APM_PROCESSOR_H
+
+#include <cstdint>
+#include <memory>
+
+namespace voicecat::audio {
+
+class ApmProcessor {
+   public:
+    virtual ~ApmProcessor() = default;
+
+    // Feed the most recent playback reference (for AEC). Call before process_capture().
+    virtual void process_render(const int16_t* pcm, int samples, int sample_rate) = 0;
+
+    // Process one capture frame in-place (AEC, NS, AGC).
+    // Returns true if VAD detects speech (or always true in passthrough mode).
+    // Returns false → caller should skip encode/send (silence gate).
+    virtual bool process_capture(int16_t* pcm, int samples, int sample_rate) = 0;
+
+    // Factory: returns a real APM if VOICECAT_HAS_APM is defined, else a passthrough.
+    static std::unique_ptr<ApmProcessor> create();
+};
+
+}  // namespace voicecat::audio
+
+#endif  // VOICECAT_AUDIO_APM_PROCESSOR_H