Convert the remaining oper bypass/visibility gates to named privileges:
channels/restricted-create, channels/ignore-nonicks, users/ignore-callerid,
users/secret-whois, users/ignore-restrictmsg, servers/use-disabled-commands,
servers/ignore-securelist, servers/ignore-blockamsg. The override class gains
the channel/message/anti-spam bypasses, auspex gains secret-whois +
ignore-callerid, server gains use-disabled-commands; netadmin keeps all via
privs=*. Docs updated; verified restricted-create + ignore-nonicks live.
README + operators.md now cover the three permission axes (commands, named
privileges, usermode/chanmode allowlists) with the *,-token syntax, the standard
privileges table (users/auspex, channels/auspex, servers/auspex, channels/override,
users/flood, users/ignore-commonchans), and the connect-notice auspex redaction.
