feat(beta): External Beta — passwords, channel join, mute, bookmarks, encrypted identity

The v0.3 client could only ever connect to a hardcoded default
channel with no password and offered no controls mid-call.
External Beta closes those gaps and tightens identity-at-rest.

User-facing additions
---------------------

* **Server password** on the connect form. Plumbed through
  `BridgeError`-aware `connect(host, nickname, password)`. Empty
  string means "no password" — no behaviour change for open
  servers.
* **Channel join**: tapping a row (or its login icon) in the
  channel tree issues a `client_move`. Names containing "🔒" or
  "password" prompt for a channel password first.
* **Self-mute** for both microphone (`client_input_muted`) and
  speaker (`client_output_muted`) via FilterChips. Output mute
  also flips the audio engine's local output-muted flag so
  playback silences immediately, before the server acknowledges.
* **Master output gain** slider (0–200%). Plumbed through an
  `AtomicU32` (f32 bits) on the engine that the cpal output
  callback multiplies into every sample.
* **Bookmarks**: SQLite-backed list with Save / Connect / Delete
  actions. Bookmarks persist across app restarts; tapping one
  pre-fills the form and dials immediately.

Hardening
---------

* **Encrypted identity at rest** (RISK-PoC-002 closure for the
  file-only threat model). ChaCha20-Poly1305 envelope: nonce +
  ciphertext written atomically with mode 0600; 32-byte DEK in a
  separate `identity.dek` file. Legacy plaintext identity files
  are auto-detected, read, and upgraded on the next save. Full OS-
  keyring integration is still v0.4 work — documented in the
  store's doc comment.
* **Mobile voice-comm routing**: on Android, `AudioEngine::start`
  uses JNI to set `AudioManager.setMode(MODE_IN_COMMUNICATION)`
  when `cfg.mobile_voice_preset` is true (default). This engages
  the device-side AEC/NS pipeline on most Pixel/Moto/Samsung
  hardware even though cpal still opens the AAudio default input
  preset. Full `setInputPreset(VOICE_COMMUNICATION)` switch is
  still RISK-AUDIO-MOBILE-001 (needs cpal upstream or an Oboe
  fork).
* **Log noise**: bridge default `EnvFilter` now silences
  `tsproto::resend=error` and `tsproto::packet_codec=error` so
  the redacted diagnostic export is human-readable. Still
  overridable via `RUST_LOG=...`.

Engineering
-----------

* **`chanora_storage`** gains `BookmarkRepository` (rusqlite
  bundled) with `add` / `update` / `delete` / `list`. The
  identity store now layers on `chacha20poly1305` + `rand` +
  `zeroize` for the envelope.
* **`chanora_protocol`** exposes `move_to_channel` and
  `set_muted` on `ProtocolClient`, dispatched through the
  existing `connection_task` request channel onto tsclientlib's
  generated `client.client_move(...)` and
  `state.client_update().set_input_muted/set_output_muted(...)`
  paths.
* **`chanora_core::ChanoraSession`** wires the bookmark store
  next to the identity store inside `init_storage`, and adds
  `list_bookmarks` / `add_bookmark` / `update_bookmark` /
  `delete_bookmark` / `move_to_channel` / `set_self_muted` /
  `set_output_gain`.
* **`chanora_audio::AudioEngine`** carries `output_gain` and
  `output_muted` atomics; the output callback consults both. The
  Android branch of `start()` engages MODE_IN_COMMUNICATION via
  a small JNI helper that reuses the `ndk_context` global set by
  the bridge's `android_init` hook.
* **`chanora_bridge::api`** adds `set_input_muted`,
  `set_output_muted`, `set_output_gain`, `move_to_channel`,
  `list_bookmarks`, `add_bookmark`, `update_bookmark`,
  `delete_bookmark`, and the `BridgeBookmark` DTO. FRB v2.12
  codegen regenerated.

Tests + CI
----------

* `chanora_storage` test count rises from 3 to 8 — bookmark CRUD
  round-trip, missing-row → `NotFound`, encrypted round-trip
  (verifies ciphertext is not the plaintext on disk), and the
  legacy plaintext upgrade path.
* New `.github/workflows/ci.yml`: `cargo check --workspace`,
  `cargo test --workspace --no-fail-fast`, `cargo clippy`
  (advisory), `flutter analyze`, and `flutter test` excluding
  the live-server `e2e` tag.

Live-verified on Moto G Stylus 5G against cn.teamspeak.app:
saved a bookmark, reconnected via it, joined a non-default
channel via tap, toggled both mutes, slid the volume, and the
redacted diagnostic export confirmed `AudioManager mode set to
MODE_IN_COMMUNICATION`, `client_move sent`, and `client_update
sent` lines.

crates/chanora_bridge/src/api.rs

@@ -51,6 +51,12 @@ fn log_sink() -> &'static chanora_core::InMemoryLogSink {
 
 // ---------- Bridge lifecycle ----------
 
+/// Default tracing filter. Suppresses the chatty
+/// `tsproto::resend` and `tsproto::packet_codec` paths that
+/// flood the diagnostic export during transient packet loss;
+/// users can still raise verbosity via `RUST_LOG=info`.
+const DEFAULT_LOG_FILTER: &str = "info,tsproto::resend=error,tsproto::packet_codec=error";
+
 /// Initialise the bridge. Must be called once on Dart side before
 /// any other API call. Sets up panic logging.
 #[frb(init)]
@@ -71,7 +77,7 @@ pub fn bridge_init() {
         use tracing_subscriber::util::SubscriberInitExt;
         let android_layer = tracing_android::layer("chanora").ok();
         let filter = tracing_subscriber::EnvFilter::try_from_default_env()
-            .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info"));
+            .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new(DEFAULT_LOG_FILTER));
         let _ = tracing_subscriber::registry()
             .with(filter)
             .with(android_layer)
@@ -85,7 +91,7 @@ pub fn bridge_init() {
         use tracing_subscriber::util::SubscriberInitExt;
         let fmt_layer = tracing_subscriber::fmt::layer().with_target(true);
         let filter = tracing_subscriber::EnvFilter::try_from_default_env()
-            .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info"));
+            .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new(DEFAULT_LOG_FILTER));
         let _ = tracing_subscriber::registry()
             .with(filter)
             .with(fmt_layer)
@@ -176,11 +182,18 @@ impl From<chanora_protocol::ServerSnapshot> for BridgeSnapshot {
 /// Connect to a TeamSpeak-compatible server and return the initial
 /// state snapshot. Honours the DEC-006 single-connection invariant
 /// via [`BridgeError::AlreadyConnected`].
-pub async fn connect(host: String, nickname: String) -> Result<BridgeSnapshot, BridgeError> {
+///
+/// `password` is optional — pass an empty string for servers that
+/// don't require one.
+pub async fn connect(
+    host: String,
+    nickname: String,
+    password: String,
+) -> Result<BridgeSnapshot, BridgeError> {
     let cfg = chanora_core::ConnectConfig {
         address: host,
         nickname,
-        password: None,
+        password: if password.is_empty() { None } else { Some(password) },
         identity: None,
         ready_timeout: Duration::from_secs(15),
     };
@@ -242,6 +255,52 @@ pub async fn set_ptt(active: bool) -> Result<(), BridgeError> {
     Ok(())
 }
 
+/// Move our own client to `channel_id`. Optional channel password
+/// for password-protected channels — pass an empty string when not
+/// required.
+pub async fn move_to_channel(channel_id: u64, password: String) -> Result<(), BridgeError> {
+    let pw = if password.is_empty() { None } else { Some(password) };
+    runtime()
+        .spawn(async move { session().move_to_channel(channel_id, pw).await })
+        .await
+        .map_err(|e| BridgeError::Unmapped(format!("join: {e}")))??;
+    Ok(())
+}
+
+/// Toggle self input-mute (microphone) on the server. Independent
+/// of push-to-talk: a muted client never transmits regardless of
+/// PTT state.
+pub async fn set_input_muted(muted: bool) -> Result<(), BridgeError> {
+    runtime()
+        .spawn(async move { session().set_self_muted(Some(muted), None).await })
+        .await
+        .map_err(|e| BridgeError::Unmapped(format!("join: {e}")))??;
+    Ok(())
+}
+
+/// Toggle self output-mute (speaker). Mutes locally *and* informs
+/// the server. The server uses this for the channel icon next to
+/// the client name; the local mute kicks in immediately even
+/// before the server acknowledges.
+pub async fn set_output_muted(muted: bool) -> Result<(), BridgeError> {
+    runtime()
+        .spawn(async move { session().set_self_muted(None, Some(muted)).await })
+        .await
+        .map_err(|e| BridgeError::Unmapped(format!("join: {e}")))??;
+    Ok(())
+}
+
+/// Set master output gain. `1.0` is unity, `0.0` is silent. Values
+/// above `1.0` amplify and can clip downstream. Errors when audio
+/// is not started.
+pub async fn set_output_gain(gain: f32) -> Result<(), BridgeError> {
+    runtime()
+        .spawn(async move { session().set_output_gain(gain).await })
+        .await
+        .map_err(|e| BridgeError::Unmapped(format!("join: {e}")))??;
+    Ok(())
+}
+
 /// Statistics from the audio engine.
 #[derive(Debug, Clone)]
 pub struct BridgeAudioStats {
@@ -294,6 +353,89 @@ pub async fn init_storage(dir: String) -> Result<(), BridgeError> {
     Ok(())
 }
 
+/// Bookmark DTO mirroring [`chanora_core::Bookmark`].
+#[derive(Debug, Clone)]
+pub struct BridgeBookmark {
+    /// Row id assigned by SQLite. Use `0` when adding new rows;
+    /// the returned id is then meaningful.
+    pub id: i64,
+    /// User-facing label.
+    pub display_name: String,
+    /// `hostname[:port]` or TSDNS name.
+    pub host: String,
+    /// Nickname to use for this bookmark.
+    pub nickname: String,
+    /// Optional remembered password. Empty string = none.
+    pub password: String,
+}
+
+impl From<chanora_core::Bookmark> for BridgeBookmark {
+    fn from(b: chanora_core::Bookmark) -> Self {
+        Self {
+            id: b.id,
+            display_name: b.display_name,
+            host: b.host,
+            nickname: b.nickname,
+            password: b.password.unwrap_or_default(),
+        }
+    }
+}
+
+impl From<BridgeBookmark> for chanora_core::Bookmark {
+    fn from(b: BridgeBookmark) -> Self {
+        chanora_core::Bookmark {
+            id: b.id,
+            display_name: b.display_name,
+            host: b.host,
+            nickname: b.nickname,
+            password: if b.password.is_empty() {
+                None
+            } else {
+                Some(b.password)
+            },
+        }
+    }
+}
+
+/// List persisted bookmarks.
+pub async fn list_bookmarks() -> Result<Vec<BridgeBookmark>, BridgeError> {
+    let v = runtime()
+        .spawn(async { session().list_bookmarks().await })
+        .await
+        .map_err(|e| BridgeError::Unmapped(format!("join: {e}")))??;
+    Ok(v.into_iter().map(Into::into).collect())
+}
+
+/// Insert a bookmark and return its assigned id. The `id` field on
+/// the input is ignored.
+pub async fn add_bookmark(b: BridgeBookmark) -> Result<i64, BridgeError> {
+    let core_b: chanora_core::Bookmark = b.into();
+    let id = runtime()
+        .spawn(async move { session().add_bookmark(core_b).await })
+        .await
+        .map_err(|e| BridgeError::Unmapped(format!("join: {e}")))??;
+    Ok(id)
+}
+
+/// Update an existing bookmark.
+pub async fn update_bookmark(b: BridgeBookmark) -> Result<(), BridgeError> {
+    let core_b: chanora_core::Bookmark = b.into();
+    runtime()
+        .spawn(async move { session().update_bookmark(core_b).await })
+        .await
+        .map_err(|e| BridgeError::Unmapped(format!("join: {e}")))??;
+    Ok(())
+}
+
+/// Delete a bookmark by id.
+pub async fn delete_bookmark(id: i64) -> Result<(), BridgeError> {
+    runtime()
+        .spawn(async move { session().delete_bookmark(id).await })
+        .await
+        .map_err(|e| BridgeError::Unmapped(format!("join: {e}")))??;
+    Ok(())
+}
+
 // ---------- Connectivity (A.6.1) ----------
 
 /// Coarse OS-reported network state. Mirrors