Moves the customer client onto the hardened stack. Both pins go together
because the fix spans both halves:

  * MyOwnMesh v0.3.2 — the auth handshake now binds the DTLS certificate
    fingerprint into the signed ed25519 payload, so a MITM on the
    (unauthenticated) signaling path can't sit between a technician and a
    customer while both sides still authenticate cleanly. Inbound frames
    are also gated on peer admission, so nothing is dispatched before
    authentication + approval. The signed handshake payload changed, so a
    v0.3.2 node and a pre-v0.3.2 daemon don't agree — the daemon sidecar
    can't lag the node here.
  * AllMyStuff v0.2.48 — the node engine the client runs in CEC client
    mode, riding that daemon: media-capture offers are now authorized
    (a technician's ScreenView consent grant is required before this
    machine will source screen/camera/mic), and unsolicited
    `OwnershipControl::Claimed` is rejected unless this device sent the
    matching Claim.

Pin sites, only some of which are .rev files:
  * .allmystuff-rev / .myownmesh-rev — the allmystuff-serve and myownmesh
    sidecar releases build.rs stages and the installer bundles.
  * gui/src-tauri/Cargo.toml — the three linked source crates
    (allmystuff-node, -cec-protocol, -cec-consent) carry their own git
    tags outside .rev; bumped in lockstep so the compiled-in code matches
    the sidecars.

No CEC-side code change is needed: the node-control contract the client
drives is unchanged in this cut. v0.3.2 is published; v0.2.48 is cut
separately from the matching AllMyStuff branch, and until that tag exists
the Tauri build's git deps won't resolve (this repo's check CI builds only
the frontend + the service crate, so it is unaffected).
gui/src-tauri/Cargo.lock stays as-is per repo convention — it refreshes on
the next real release build.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019xdiiiYN3ThDwnuHfqQnEy