Group the module crates under modules/

The service pseudo-clients and the ircd protocol link sat flat at the
repo root, mixed in with the daemon core and the SDK. Move them all
under modules/ so the tree separates concerns cleanly: the daemon in
src/, the SDK every module links against in api/, and the loadable
modules — the pseudo-clients plus the protocol link — in modules/.

Workspace members, the daemon's per-crate dependency paths, and each
module's api path are updated to match; the docs follow. No code change.

modules/nickserv/src/confirm.rs

@@ -0,0 +1,26 @@
+use fedserv_api::{CodeKind, Store};
+use fedserv_api::{Sender, ServiceCtx};
+
+// CONFIRM <code>: confirm your account's email with the code you were emailed.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    let Some(&code) = args.get(1) else {
+        ctx.notice(me, from.uid, "Syntax: CONFIRM <code>");
+        return;
+    };
+    let Some(account) = from.account.map(str::to_string).or_else(|| db.resolve_account(from.nick).map(str::to_string)) else {
+        ctx.notice(me, from.uid, "You don't have an account to confirm.");
+        return;
+    };
+    if db.is_verified(&account) {
+        ctx.notice(me, from.uid, format!("\x02{account}\x02 is already confirmed."));
+        return;
+    }
+    if !db.take_code(&account, CodeKind::Confirm, code) {
+        ctx.notice(me, from.uid, "Invalid or expired confirmation code.");
+        return;
+    }
+    match db.verify_account(&account) {
+        Ok(()) => ctx.notice(me, from.uid, format!("\x02{account}\x02 is now confirmed. Thanks!")),
+        Err(_) => ctx.notice(me, from.uid, "Sorry, that didn't work. Please try again in a moment."),
+    }
+}