NickServ GETEMAIL + ChanServ SET RESTRICTED

GETEMAIL (auspex) lists accounts whose email matches a glob. SET
RESTRICTED makes a channel kick anyone without access (or oper) as they
join, mirroring the SECUREOPS on-join enforcement.

src/engine/db/channel.rs

@@ -197,6 +197,7 @@ impl Db {
             ChanSetting::Private => settings.private = on,
             ChanSetting::Peace => settings.peace = on,
             ChanSetting::SecureOps => settings.secureops = on,
+            ChanSetting::Restricted => settings.restricted = on,
             ChanSetting::KeepTopic => settings.keeptopic = on,
             ChanSetting::TopicLock => settings.topiclock = on,
             ChanSetting::BotGreet => settings.bot_greet = on,

src/engine/db/mod.rs

@@ -343,6 +343,9 @@ pub struct ChanSettings {
     // Strip channel-operator status from anyone without op-level access.
     #[serde(default)]
     pub secureops: bool,
+    // Kick anyone without channel access when they join.
+    #[serde(default)]
+    pub restricted: bool,
     // Remember the topic and restore it when the channel is recreated.
     #[serde(default)]
     pub keeptopic: bool,

src/engine/db/store.rs

@@ -22,6 +22,12 @@ impl Store for Db {
             .map(|a| AccountView { name: a.name.clone(), email: a.email.clone(), ts: a.ts, verified: a.verified, greet: a.greet.clone() })
             .collect()
     }
+    fn accounts_by_email(&self, pattern: &str) -> Vec<String> {
+        self.accounts()
+            .filter(|a| a.email.as_deref().is_some_and(|e| super::glob_match(pattern, e)))
+            .map(|a| a.name.clone())
+            .collect()
+    }
     fn authenticate(&self, name: &str, password: &str) -> Option<&str> {
         Db::authenticate(self, name, password)
     }