HostServ: forbidden-vhost patterns + auto-vhost template

FORBID <regex> / FORBIDLIST / FORBIDDEL let operators block impersonating
user requests (e.g. (?i)(admin|staff)); REQUEST refuses a matching host.
Matching reuses the linear-time RegexSet, so untrusted patterns are safe.

TEMPLATE <$account...> sets a network auto-vhost pattern; DEFAULT gives a
user $account.users.example with their sanitised account name. HostServ's
node config (offers/forbidden/template) is consolidated into one HostConfig
threaded through the log replay.

src/grpc.rs

@@ -154,7 +154,10 @@ fn to_wire(entry: &LogEntry) -> Option<ReplicationEvent> {
         | Event::BotAdded(_)
         | Event::BotRemoved { .. }
         | Event::VhostOfferAdded { .. }
-        | Event::VhostOfferRemoved { .. } => return None,
+        | Event::VhostOfferRemoved { .. }
+        | Event::VhostForbidAdded { .. }
+        | Event::VhostForbidRemoved { .. }
+        | Event::VhostTemplateSet { .. } => return None,
     };
     Some(ReplicationEvent { origin: entry.origin().to_string(), seq: entry.seq(), lamport: entry.lamport(), kind: Some(kind) })
 }