Group the module crates under modules/

The service pseudo-clients and the ircd protocol link sat flat at the
repo root, mixed in with the daemon core and the SDK. Move them all
under modules/ so the tree separates concerns cleanly: the daemon in
src/, the SDK every module links against in api/, and the loadable
modules — the pseudo-clients plus the protocol link — in modules/.

Workspace members, the daemon's per-crate dependency paths, and each
module's api path are updated to match; the docs follow. No code change.

modules/nickserv/src/resetpass.rs

@@ -0,0 +1,39 @@
+use fedserv_api::{CodeKind, Store};
+use fedserv_api::{Sender, ServiceCtx};
+
+// RESETPASS <account>: email a reset code to the address on file.
+// RESETPASS <account> <code> <newpassword>: complete the reset with that code.
+pub fn handle(me: &str, from: &Sender, args: &[&str], ctx: &mut ServiceCtx, db: &mut dyn Store) {
+    if !db.email_enabled() {
+        ctx.notice(me, from.uid, "Password reset by email isn't available here.");
+        return;
+    }
+    match (args.get(1), args.get(2), args.get(3)) {
+        (Some(&name), None, None) => {
+            let Some(canonical) = db.resolve_account(name).map(str::to_string) else {
+                ctx.notice(me, from.uid, format!("\x02{name}\x02 isn't registered."));
+                return;
+            };
+            let Some(email) = db.account(&canonical).and_then(|a| a.email.clone()) else {
+                ctx.notice(me, from.uid, "That account has no email on file, so it can't be reset.");
+                return;
+            };
+            let code = db.issue_code(&canonical, CodeKind::Reset);
+            let mail = fedserv_api::email::reset(db.email_brand(), db.email_accent(), db.email_logo(), &canonical, &code);
+            ctx.send_email(email, mail.subject, mail.text, Some(mail.html));
+            ctx.notice(me, from.uid, format!("A reset code has been emailed to the address on file for \x02{canonical}\x02."));
+        }
+        (Some(&name), Some(&code), Some(&newpass)) => {
+            let Some(canonical) = db.resolve_account(name).map(str::to_string) else {
+                ctx.notice(me, from.uid, format!("\x02{name}\x02 isn't registered."));
+                return;
+            };
+            if !db.take_code(&canonical, CodeKind::Reset, code) {
+                ctx.notice(me, from.uid, "Invalid or expired reset code.");
+                return;
+            }
+            ctx.defer_password(&canonical, newpass, me, from.uid);
+        }
+        _ => ctx.notice(me, from.uid, "Syntax: RESETPASS <account> [<code> <newpassword>]"),
+    }
+}