Add a JSON-RPC stats endpoint for websites

Plain HTTP + JSON-RPC 2.0 (axum, already in the tree) so a site backend
can pull stats without gRPC stubs. Methods: stats.get (counters + gauges)
and stats.channel { channel } (lines + top talkers). Optional [jsonrpc]
config, off unless set.

Security: bearer-token authenticated with a constant-time compare, refuses
to start with an empty token, read-only (only stats.* methods — no way to
mutate state), method-allowlisted, a 64 KiB body limit, and meant to bind
to localhost beside the backend.

src/config.rs

@@ -16,6 +16,10 @@ pub struct Config {
     // directory. Absent = the RPC server does not start.
     #[serde(default)]
     pub grpc: Option<Grpc>,
+    // JSON-RPC stats endpoint (plain HTTP+JSON) for a website's stats pages.
+    // Absent = it does not start. Bind to localhost; a token is required.
+    #[serde(default)]
+    pub jsonrpc: Option<JsonRpc>,
     // Which service modules to start. Absent = the built-in NickServ + ChanServ.
     #[serde(default)]
     pub modules: Modules,
@@ -90,6 +94,14 @@ pub struct ServerTls {
     pub key: String,  // private key (PEM)
 }
 
+#[derive(Debug, Deserialize, Clone)]
+pub struct JsonRpc {
+    // Address to accept HTTP on, e.g. "127.0.0.1:5601". Keep it on localhost.
+    pub bind: String,
+    // Bearer token every request must present (`authorization: Bearer <token>`).
+    pub token: String,
+}
+
 #[derive(Debug, Deserialize, Clone)]
 pub struct Email {
     // Sender address stamped on outgoing mail.