OperServ: DEFCON network defence levels

DEFCON [1-5] reads or sets a network-wide defence posture, each level
adding a restriction the engine and services enforce:
- 4: channel registrations frozen (ChanServ REGISTER)
- 3: all registrations frozen (the pre_register_check choke-point, covering
     NickServ and the IRCv3 relay, plus channels)
- 2: sessions additionally capped to one per host
- 1: full lockdown — new connections are turned away on connect

Setting a level announces it to the whole network. Node-local level on the
db so services can read the derived freezes; admin-only.

chanserv/src/lib.rs

@@ -72,6 +72,10 @@ impl Service for ChanServ {
                     ctx.notice(me, from.uid, "Channel names start with \x02#\x02.");
                     return;
                 }
+                if db.channel_regs_frozen() {
+                    ctx.notice(me, from.uid, "Channel registrations are temporarily frozen by network staff. Please try again later.");
+                    return;
+                }
                 // The founder is the account the sender is identified to.
                 let Some(account) = from.account else {
                     ctx.notice(me, from.uid, "You need to be logged in to register a channel. Identify to NickServ first.");