botserv: op assigned bots on join; statserv: persist counters across restart

Problem 1: an assigned bot joined via IJOIN with no status mode, so it had no
+o. Join it with the 4-param IJOIN form (ts 1, mode o) so it's opped, matching
Anope's default bot modes (+o), and exempt bots from SECUREOPS/RESTRICTED so the
op is never stripped.

Problem 2: the shared stat counters lived only in memory, so a restart wiped
them. Snapshot them to the log (StatsSet event, folded into NetData + compaction)
periodically and on shutdown, and reseed the live registry from the log at
startup. Live gauges (online counts) stay re-derived, not stored.

src/engine/db/event.rs

@@ -136,6 +136,9 @@ pub enum Event {
     // by minting a fake one on `sid`), so Local scope but still persisted.
     JupeAdded { name: String, sid: String, reason: String },
     JupeRemoved { name: String },
+    // A full snapshot of the shared stat counters (StatServ / gRPC Stats),
+    // written periodically and on shutdown so they survive a restart.
+    StatsSet { counters: Vec<(String, u64)> },
 }
 
 // Whether an event replicates across the federation. Account identity is Global
@@ -238,7 +241,8 @@ impl Event {
             | Event::ChannelExpiryWarned { .. }
             | Event::ChannelOperNoteSet { .. }
             | Event::JupeAdded { .. }
-            | Event::JupeRemoved { .. } => Scope::Local,
+            | Event::JupeRemoved { .. }
+            | Event::StatsSet { .. } => Scope::Local,
         }
     }
 }
@@ -623,6 +627,10 @@ pub(crate) fn apply(accounts: &mut HashMap<String, Account>, channels: &mut Hash
         Event::JupeRemoved { name } => {
             net.jupes.retain(|j| !j.name.eq_ignore_ascii_case(&name));
         }
+        Event::StatsSet { counters } => {
+            // A full snapshot: replace, so replaying the newest wins.
+            net.stats = counters.into_iter().collect();
+        }
         Event::AccountExpiryWarned { account } => {
             if let Some(a) = accounts.get_mut(&key(&account)) {
                 a.expiry_warned = true;