nickserv/security: password policy, auth throttle, unguessable codes

Three brute-force / weak-secret gaps closed:
- REGISTER and SET PASSWORD now enforce a length range and reject a password
  equal to the nick (Anope's minpasslen/not-nick rules), with tests.
- IDENTIFY is throttled per account: a few free tries then an exponential
  backoff that clears on success, so a password can't be ground down. SASL had
  a limiter; interactive login had none.
- Emailed confirm/reset codes go from 6 digits to 8 base32 chars (~40 bits) and
  are burned after a few wrong guesses, closing a reset-code takeover window.
Throttle and code state are node-local and in-memory (not in the event log).

api/src/lib.rs

@@ -386,6 +386,10 @@ pub trait Store {
 
     fn issue_code(&mut self, account: &str, kind: CodeKind) -> String;
     fn take_code(&mut self, account: &str, kind: CodeKind, code: &str) -> bool;
+    // Brute-force throttle for password authentication: how long the account is
+    // locked out (if at all), and a hook to record each attempt's outcome.
+    fn auth_lockout(&self, account: &str) -> Option<u64>;
+    fn note_auth(&mut self, account: &str, success: bool);
     fn verify_account(&mut self, account: &str) -> Result<(), RegError>;
     fn set_email(&mut self, account: &str, email: Option<String>) -> Result<(), RegError>;
     fn group_nick(&mut self, nick: &str, account: &str) -> Result<(), RegError>;