OperServ: per-IP session limiting with exceptions

The connection that puts an IP over its allowance is killed on connect.
The ircd's per-user IP (UID param 7) is now plumbed through UserConnect and
tracked per-IP in the live network view (incremented on connect, released
on quit).

- [session] default_limit sets the base allowance (0/absent = off).
- OperServ SESSION LIST <min> / VIEW <ip> inspect live counts.
- OperServ EXCEPTION ADD <ip-mask> <limit> [reason] / DEL / LIST override
  the limit per IP-mask (limit 0 = unlimited); event-sourced so they
  federate and survive restart, matched most-permissive-wins.

All admin-gated.

src/config.rs

@@ -32,6 +32,23 @@ pub struct Config {
     // Inactivity-expiry. Absent = accounts and channels never expire.
     #[serde(default)]
     pub expire: Option<Expire>,
+    // Per-IP session limiting. Absent = unlimited.
+    #[serde(default)]
+    pub session: Option<Session>,
+}
+
+// Session limiting: the default connections allowed per IP (0/absent = off),
+// which OperServ EXCEPTION entries can raise or lower per IP-mask.
+#[derive(Debug, Deserialize, Clone)]
+pub struct Session {
+    #[serde(default)]
+    pub default_limit: u32,
+}
+
+impl Session {
+    pub fn limit(&self) -> Option<u32> {
+        (self.default_limit > 0).then_some(self.default_limit)
+    }
 }
 
 // Inactivity-expiry thresholds, in days. A zero (or omitted) field leaves that