A holder's channel messages reach +D (deaf) members: gate the deaf-skip in
to_channel_tagged and the TAGMSG fanout on the sender's users/ignore-privdeaf
(relayed/service messages, which have no local sender, are unaffected). Granted
by the auspex class; verified live (netadmin reaches a deaf user, a restricted
oper does not).
Convert the remaining oper bypass/visibility gates to named privileges:
channels/restricted-create, channels/ignore-nonicks, users/ignore-callerid,
users/secret-whois, users/ignore-restrictmsg, servers/use-disabled-commands,
servers/ignore-securelist, servers/ignore-blockamsg. The override class gains
the channel/message/anti-spam bypasses, auspex gains secret-whois +
ignore-callerid, server gains use-disabled-commands; netadmin keeps all via
privs=*. Docs updated; verified restricted-create + ignore-nonicks live.
README + operators.md now cover the three permission axes (commands, named
privileges, usermode/chanmode allowlists) with the *,-token syntax, the standard
privileges table (users/auspex, channels/auspex, servers/auspex, channels/override,
users/flood, users/ignore-commonchans), and the connect-notice auspex redaction.
