feat(M2): UDP voice/media plane -- SFU relay, Opus, AEAD, jitter buffer

Adds the full voice pipeline: 14-byte binary frame header, ChaCha20-Poly1305
AEAD keyed from the TLS exporter, libopus encode/decode with FEC/PLC/DTX,
an adaptive per-ssrc jitter buffer, a miniaudio capture/playback engine, an
APM passthrough stub, and the UdpBinding/StreamAnnounce signaling chain
wired through ConnSession/SessionRegistry into a new server-side SFU
(MediaRelay) that decrypts and re-encrypts frames per channel member.

Exit criterion verified: test_m2_voice — two headless clients relay 50
encrypted Opus frames through the server; ctest --preset m1-dev is 9/9
green. Also corrects protocol.md's UdpBinding diagram, which described the
UDP-side binding packet as AEAD-sealed when it is in fact a plaintext
bootstrap frame (separate from the TCP/TLS UdpBinding ack).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/src/net/transport.cpp

@@ -175,6 +175,8 @@ void TcpServerConn::start() {
                 return;
             }
             self->connected_.store(true, std::memory_order_release);
+            // Export media keying material before the read loop starts.
+            if (self->cbs_.on_tls_ready) self->cbs_.on_tls_ready(*self->tls_);
             // 50 ms timeout so tls_read_loop can drain the send queue between reads.
             self->tls_->set_read_timeout(50);
             self->tls_thread_ = std::thread([self] { self->tls_read_loop(); });
@@ -351,6 +353,67 @@ void TcpAcceptor::do_accept() {
         });
 }
 
+// ── UdpMediaChannel ──────────────────────────────────────────────────────────
+
+bool UdpMediaChannel::bind(asio::io_context& io, uint16_t port) {
+    if (bound_.load()) return false;
+    try {
+        socket_ = std::make_unique<asio::ip::udp::socket>(io);
+        socket_->open(asio::ip::udp::v4());
+        socket_->set_option(asio::socket_base::reuse_address(true));
+        socket_->bind(asio::ip::udp::endpoint(asio::ip::udp::v4(), port));
+        bound_.store(true, std::memory_order_release);
+        return true;
+    } catch (...) {
+        socket_.reset();
+        return false;
+    }
+}
+
+void UdpMediaChannel::start_recv(FrameCallback cb) {
+    frame_cb_ = std::move(cb);
+    do_recv();
+}
+
+void UdpMediaChannel::do_recv() {
+    if (!socket_ || closed_.load()) return;
+    socket_->async_receive_from(
+        asio::buffer(recv_buf_), sender_ep_,
+        [this](std::error_code ec, std::size_t n) {
+            if (ec || closed_.load()) return;
+            if (frame_cb_ && n > 0)
+                frame_cb_(recv_buf_.data(), n, sender_ep_);
+            do_recv();
+        });
+}
+
+void UdpMediaChannel::send_to(const uint8_t* data, size_t len,
+                               asio::ip::udp::endpoint dst) {
+    if (!socket_ || closed_.load() || len == 0) return;
+    auto buf = std::make_shared<std::vector<uint8_t>>(data, data + len);
+    asio::post(socket_->get_executor(), [this, buf, dst]() mutable {
+        if (closed_.load()) return;
+        socket_->async_send_to(
+            asio::buffer(*buf), dst,
+            [buf](std::error_code, std::size_t) {});
+    });
+}
+
+void UdpMediaChannel::close() {
+    if (closed_.exchange(true)) return;
+    if (socket_) {
+        std::error_code ec;
+        socket_->cancel(ec);
+        socket_->close(ec);
+    }
+}
+
+asio::ip::udp::endpoint UdpMediaChannel::local_endpoint() const {
+    if (!socket_) return {};
+    std::error_code ec;
+    return socket_->local_endpoint(ec);
+}
+
 }  // namespace voicecat::net
 
 #endif  // VOICECAT_HAS_NET