OperServ: DEFCON network defence levels

DEFCON [1-5] reads or sets a network-wide defence posture, each level
adding a restriction the engine and services enforce:
- 4: channel registrations frozen (ChanServ REGISTER)
- 3: all registrations frozen (the pre_register_check choke-point, covering
     NickServ and the IRCv3 relay, plus channels)
- 2: sessions additionally capped to one per host
- 1: full lockdown — new connections are turned away on connect

Setting a level announces it to the whole network. Node-local level on the
db so services can read the derived freezes; admin-only.

api/src/lib.rs

@@ -771,6 +771,11 @@ pub trait Store {
     fn jupe_add(&mut self, name: &str, reason: &str) -> String;
     fn jupe_del(&mut self, name: &str) -> Option<String>;
     fn jupes(&self) -> Vec<(String, String, String)>;
+    // Network defence level (OperServ DEFCON) and its derived registration freezes.
+    fn defcon(&self) -> u8;
+    fn set_defcon(&mut self, level: u8);
+    fn registrations_frozen(&self) -> bool;
+    fn channel_regs_frozen(&self) -> bool;
     // Staff notes on accounts/channels (oper-only), shown in INFO to operators.
     fn set_account_note(&mut self, account: &str, note: Option<String>) -> bool;
     fn account_note(&self, account: &str) -> Option<String>;