feat: auto-resume music on reconnect, sorcerer tier, cert auth

Auto-resume: save playback position on stream errors and cancellation,
restore automatically after reconnect or container restart once the
channel is silent. Plugin lifecycle hook (on_connected) ensures the
reconnect watcher starts without waiting for user commands.

Sorcerer tier: new permission level between oper and admin. Configured
via [mumble] sorcerers list in derp.toml.

Mumble cert auth: pass certfile/keyfile to pymumble for client
certificate authentication.

Fixes: stream_audio now re-raises CancelledError and Exception so
_play_loop detects failures correctly. Subprocess cleanup uses 3s
timeout. Graceful shutdown cancels background tasks before stopping
pymumble. Safe getattr for _opers in core plugin.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/USAGE.md

@@ -1592,3 +1592,53 @@ and voice transmission.
   to text commands during streaming
 - `!resume` continues from where playback was interrupted (`!stop`/`!skip`);
   position is persisted via `bot.state` and survives bot restarts
+
+### Auto-Resume on Reconnect
+
+If the bot disconnects while music is playing (network hiccup, server
+restart), it saves the current track and position. On reconnect, it
+automatically resumes playback -- but only after the channel is silent
+(using the same silence threshold as voice ducking, default 15s).
+
+- Resume state is saved on both explicit stop/skip and on stream errors
+  (disconnect)
+- Works across container restarts (cold boot) and network reconnections
+- The bot waits up to 60s for silence; if the channel stays active, it
+  aborts and the saved state remains for manual `!resume`
+- No chat message is sent on auto-resume; playback resumes silently
+- The reconnect watcher starts via the `on_connected` plugin lifecycle hook
+
+### Voice Ducking
+
+When other users speak in the Mumble channel, the music volume automatically
+ducks (lowers) to a configurable floor. After a configurable silence period,
+volume gradually restores to the user-set level in small steps.
+
+```
+!duck                  Show ducking status and settings
+!duck on               Enable voice ducking
+!duck off              Disable voice ducking
+!duck floor <0-100>    Set floor volume % (default: 1)
+!duck silence <sec>    Set silence timeout in seconds (default: 15)
+!duck restore <sec>    Set restore ramp duration in seconds (default: 30)
+```
+
+Behavior:
+
+- Enabled by default; voice is detected via pymumble's sound callback
+- When someone speaks, volume drops immediately to the floor value
+- After `silence` seconds of no voice, volume restores via a single
+  smooth linear ramp over `restore` seconds (default 30s)
+- The per-frame volume ramp in `stream_audio` further smooths the
+  transition, eliminating audible steps
+- Ducking resets when playback stops, skips, or the queue empties
+
+Configuration (optional):
+
+```toml
+[music]
+duck_enabled = true       # Enable voice ducking (default: true)
+duck_floor = 1            # Floor volume % during ducking (default: 1)
+duck_silence = 15         # Seconds of silence before restoring (default: 15)
+duck_restore = 30         # Seconds for smooth volume restore (default: 30)
+```