Group the module crates under modules/

The service pseudo-clients and the ircd protocol link sat flat at the
repo root, mixed in with the daemon core and the SDK. Move them all
under modules/ so the tree separates concerns cleanly: the daemon in
src/, the SDK every module links against in api/, and the loadable
modules — the pseudo-clients plus the protocol link — in modules/.

Workspace members, the daemon's per-crate dependency paths, and each
module's api path are updated to match; the docs follow. No code change.

modules/operserv/src/stats.rs

@@ -0,0 +1,13 @@
+use fedserv_api::{Sender, ServiceCtx, Store};
+
+// STATS: an at-a-glance summary of the enforcement state OperServ holds — how
+// many network bans of each kind and how many services ignores are live.
+// Read-only, so any operator may run it (the module is already oper-gated).
+pub fn handle(me: &str, from: &Sender, db: &mut dyn Store, ctx: &mut ServiceCtx) {
+    let akills = db.akills();
+    let glines = akills.iter().filter(|a| a.kind == "G").count();
+    let qlines = akills.iter().filter(|a| a.kind == "Q").count();
+    let rlines = akills.iter().filter(|a| a.kind == "R").count();
+    let ignores = db.ignores().len();
+    ctx.notice(me, from.uid, format!("Live network bans: \x02{glines}\x02 AKILL, \x02{qlines}\x02 SQLINE, \x02{rlines}\x02 SNLINE. Services ignores: \x02{ignores}\x02."));
+}