Retire legacy sources and verify managed iOS deployment

docs/security.md

@@ -53,7 +53,7 @@ future improvement. Until then, clients display both values but gate on the cert
 captures directional exporters during handshake completion. Its client requires an
 explicit leaf-fingerprint acceptance callback; PKI validation remains unimplemented.
 New managed server certificates include the Ed25519 public key in SAN URI
-`urn:voicecat:identity:ed25519:<lowercase-public-key-hex>`. Existing C++ credentials
+`urn:voicecat:identity:ed25519:<lowercase-public-key-hex>`. Existing pre-rewrite credentials
 are imported unchanged. Verifying that URI against the declared ServerHello identity
 is still deferred to the managed session layer; leaf-certificate TOFU remains the
 trust gate. Missing members of a persisted credential set cause startup rejection
@@ -82,7 +82,7 @@ mandatory from the first build. This was chosen over DTLS after weighing two fin
    `0x01` for server→client. Each export yields a 32-byte directional media key.
    No second handshake, no certificates on the UDP path — the UDP channel inherits the
    authenticated, MITM-resistant TLS session's trust.
-2. Each UDP voice frame is sealed with **ChaCha20-Poly1305** (libsodium in C++;
+2. Each UDP voice frame is sealed with **ChaCha20-Poly1305** (managed platform crypto;
    platform cryptography with a BouncyCastle fallback in .NET).
 3. The full 20-byte header is AEAD **associated data**. The server authenticates/decrypts
    inbound media and reseals for each recipient, replacing the sequence with that
@@ -124,7 +124,7 @@ Binding works as:
    accepts the first endpoint only; further bootstrap packets cannot replace it.
    Endpoint changes require a new authenticated session. The token remains available
    for TLS confirmation but cannot establish a second binding. Session removal retires
-   its endpoint, token and directional keys. The C++ oracle currently permits rebinding
+   its endpoint, token and directional keys. Unsupported old releases permitted rebinding
    with the same token; this differs in policy, not in the packet format.
 4. Thereafter, frames are accepted only on that bound tuple; ssrcs are checked against the
    streams the session announced. Source-address spoofing can't hijack a session because the