feat(M2): UDP voice/media plane -- SFU relay, Opus, AEAD, jitter buffer

Adds the full voice pipeline: 14-byte binary frame header, ChaCha20-Poly1305
AEAD keyed from the TLS exporter, libopus encode/decode with FEC/PLC/DTX,
an adaptive per-ssrc jitter buffer, a miniaudio capture/playback engine, an
APM passthrough stub, and the UdpBinding/StreamAnnounce signaling chain
wired through ConnSession/SessionRegistry into a new server-side SFU
(MediaRelay) that decrypts and re-encrypts frames per channel member.

Exit criterion verified: test_m2_voice — two headless clients relay 50
encrypted Opus frames through the server; ctest --preset m1-dev is 9/9
green. Also corrects protocol.md's UdpBinding diagram, which described the
UDP-side binding packet as AEAD-sealed when it is in fact a plaintext
bootstrap frame (separate from the TCP/TLS UdpBinding ack).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/src/session_registry.cpp

@@ -2,6 +2,7 @@
 
 #ifdef VOICECAT_HAS_NET
 
+#include <atomic>
 #include <mutex>
 #include <shared_mutex>
 
@@ -110,6 +111,67 @@ void SessionRegistry::broadcast(const voicecat::v1::Envelope& env,
     }
 }
 
+// ── M2: UDP / media ──────────────────────────────────────────────────────────
+
+void SessionRegistry::register_udp_token(const std::array<uint8_t, 16>& token,
+                                          uint64_t session_id) {
+    std::unique_lock lk(mu_);
+    udp_tokens_[token] = session_id;
+}
+
+std::shared_ptr<ConnSession> SessionRegistry::find_by_udp_token(
+    const std::array<uint8_t, 16>& token) const {
+    std::shared_lock lk(mu_);
+    auto it = udp_tokens_.find(token);
+    if (it == udp_tokens_.end()) return nullptr;
+    auto sit = sessions_.find(it->second);
+    if (sit == sessions_.end()) return nullptr;
+    return sit->second.lock();
+}
+
+void SessionRegistry::register_udp_endpoint(asio::ip::udp::endpoint ep,
+                                              uint64_t session_id) {
+    std::unique_lock lk(mu_);
+    udp_endpoints_[ep] = session_id;
+}
+
+std::shared_ptr<ConnSession> SessionRegistry::find_by_udp_endpoint(
+    const asio::ip::udp::endpoint& ep) const {
+    std::shared_lock lk(mu_);
+    auto it = udp_endpoints_.find(ep);
+    if (it == udp_endpoints_.end()) return nullptr;
+    auto sit = sessions_.find(it->second);
+    if (sit == sessions_.end()) return nullptr;
+    return sit->second.lock();
+}
+
+uint32_t SessionRegistry::assign_ssrc(uint64_t session_id) {
+    uint32_t ssrc = next_ssrc_.fetch_add(1, std::memory_order_relaxed);
+    std::unique_lock lk(mu_);
+    ssrc_to_session_[ssrc] = session_id;
+    return ssrc;
+}
+
+std::vector<std::shared_ptr<ConnSession>> SessionRegistry::find_channel_sessions(
+    uint32_t channel_id, uint64_t exclude_session_id) const {
+    std::shared_lock lk(mu_);
+    std::vector<std::shared_ptr<ConnSession>> result;
+    for (auto& [uid, entry] : users_) {
+        if (entry.proto.channel_id() != channel_id) continue;
+        if (entry.session_id == exclude_session_id) continue;
+        auto sit = sessions_.find(entry.session_id);
+        if (sit == sessions_.end()) continue;
+        if (auto sess = sit->second.lock()) result.push_back(sess);
+    }
+    return result;
+}
+
+uint32_t SessionRegistry::user_channel(uint32_t user_id) const {
+    std::shared_lock lk(mu_);
+    auto it = users_.find(user_id);
+    return (it == users_.end()) ? 0 : it->second.proto.channel_id();
+}
+
 }  // namespace voicecat::server
 
 #endif  // VOICECAT_HAS_NET