feat: auto-resume music on reconnect, sorcerer tier, cert auth

Auto-resume: save playback position on stream errors and cancellation,
restore automatically after reconnect or container restart once the
channel is silent. Plugin lifecycle hook (on_connected) ensures the
reconnect watcher starts without waiting for user commands.

Sorcerer tier: new permission level between oper and admin. Configured
via [mumble] sorcerers list in derp.toml.

Mumble cert auth: pass certfile/keyfile to pymumble for client
certificate authentication.

Fixes: stream_audio now re-raises CancelledError and Exception so
_play_loop detects failures correctly. Subprocess cleanup uses 3s
timeout. Graceful shutdown cancels background tasks before stopping
pymumble. Safe getattr for _opers in core plugin.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/CHEATSHEET.md

@@ -557,12 +557,19 @@ HTML stripped on receive, escaped on send. IRC-only commands are no-ops.
 !np                      # Now playing
 !volume                  # Show current volume
 !volume 75               # Set volume (0-100, default 50)
+!duck                    # Show ducking status
+!duck on                 # Enable voice ducking
+!duck off                # Disable voice ducking
+!duck floor 5            # Set duck floor volume (0-100, default 1)
+!duck silence 20         # Set silence timeout seconds (default 15)
+!duck restore 45         # Set restore ramp duration seconds (default 30)
 ```
 
 Requires: `yt-dlp`, `ffmpeg`, `libopus` on the host.
 Max 50 tracks in queue. Playlists auto-expand; excess truncated at limit.
 Volume ramps smoothly over ~1s (no abrupt jumps mid-playback).
 `!resume` restores position across restarts (persisted via `bot.state`).
+Auto-resumes on reconnect if channel is silent (waits up to 60s for silence).
 Mumble-only: `!play` replies with error on other adapters, others silently no-op.
 
 ## Plugin Template