nickserv/security: password policy, auth throttle, unguessable codes

Three brute-force / weak-secret gaps closed:
- REGISTER and SET PASSWORD now enforce a length range and reject a password
  equal to the nick (Anope's minpasslen/not-nick rules), with tests.
- IDENTIFY is throttled per account: a few free tries then an exponential
  backoff that clears on success, so a password can't be ground down. SASL had
  a limiter; interactive login had none.
- Emailed confirm/reset codes go from 6 digits to 8 base32 chars (~40 bits) and
  are burned after a few wrong guesses, closing a reset-code takeover window.
Throttle and code state are node-local and in-memory (not in the event log).

nickserv/src/lib.rs

@@ -32,6 +32,8 @@ mod resetpass;
 mod confirm;
 #[path = "ajoin.rs"]
 mod ajoin;
+#[path = "password.rs"]
+mod password;
 
 pub struct NickServ {
     pub uid: String,