TLS 1.3, channel persistence, membership signaling

- TLS 1.3 on TCP (rustls + tokio-rustls, optional self-signed cert)
- Server-side channel CRUD with SQLite persistence
- Gateway → voice-node membership bridge via broadcast channel

gateway/src/handler/run.rs

@@ -1,5 +1,5 @@
 use anyhow::Result;
-use tokio::net::TcpStream;
+use tokio::io::{AsyncRead, AsyncWrite};
 use tokio::sync::broadcast;
 use tracing::warn;
 
@@ -10,8 +10,8 @@ use crate::{
 
 use super::{Ctx, deliver::deliver_encrypted, dispatch};
 
-pub async fn run_session(
-    stream: &mut TcpStream,
+pub async fn run_session<S: AsyncRead + AsyncWrite + Unpin>(
+    stream: &mut S,
     addr: std::net::SocketAddr,
     seq: &mut u32,
     session_id: &str,