Initial commit: mumh5, a modern Mumble client

Electron desktop app with a Svelte 5 interface for any Mumble server.

- Mumble protocol core: TLS, handshake, channels, users, text, plugin data,
  client-side pacing of Murmur's rate limits
- Voice: WebCodecs Opus over the TCP tunnel, voice activity, push to talk,
  always-on, devices, per-user volume and local mute
- Several servers at once, voice on one; server rail with icons and ordering
- Chat: channels, direct messages, side chat, file sharing through f0ckm,
  inline images without it, click-to-play YouTube
- Profiles with rich descriptions, registration, rename, nicknames,
  connection information and moderation menus
- Identity wizard, multiple identities, PKCS#12 import/export, desktop
  Mumble certificate import, certificate pinning and viewer
- Tray icon with voice state
- Unit, server and end-to-end tests against a real Murmur

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/core/transport.ts

@@ -0,0 +1,42 @@
+// A reliable, ordered byte stream to a Mumble server (TLS in Electron, WebSocket proxy on the web).
+export interface Transport {
+  send(bytes: Uint8Array): void;
+  close(): void;
+  onData: ((chunk: Uint8Array) => void) | null;
+  onClose: ((reason: string) => void) | null;
+}
+
+export interface ConnectTarget {
+  host: string;
+  port: number;
+}
+
+// Identity certificate the client presents; Mumble uses it to recognize registered users.
+export interface Identity {
+  certPem: string;
+  keyPem: string;
+  fingerprint: string;
+}
+
+export interface CertDetails {
+  subject: string;
+  issuer: string;
+  validFrom: string;
+  validTo: string;
+  serialNumber: string;
+  fingerprint: string;     // SHA-1, the hash Mumble uses for users
+  fingerprint256: string;
+  subjectAltName: string;
+  keyType: string;
+  keyBits: number | null;
+  ca: boolean;
+  selfSigned: boolean;
+  pem: string;
+}
+
+export interface ServerCertInfo {
+  fingerprint: string;       // sha256 of the server certificate, colon-separated hex
+  authorized: boolean;       // true if it chains to a trusted CA
+  authError: string | null;  // why it is not trusted, e.g. DEPTH_ZERO_SELF_SIGNED_CERT
+  chain: CertDetails[];      // leaf first
+}