feat: PING watchdog, IRCv3 server-time, push notifications

PING watchdog sends PING after configurable silence interval and
disconnects on timeout, detecting stale connections that TCP alone
misses. IRCv3 server-time capability is requested on every connection;
timestamps are injected on dispatch and backlog replay for clients
that support message tags. Push notifications via ntfy or generic
webhook fire on highlights and PMs when no clients are attached,
with configurable cooldown and optional SOCKS5 routing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/CHEATSHEET.md

@@ -137,6 +137,34 @@ SASL EXTERNAL (cert + creds) > SASL PLAIN (creds) > NickServ IDENTIFY
 5s -> 10s -> 30s -> 60s -> 120s -> 300s (cap)
 ```
 
+## PING Watchdog
+
+Detects stale connections where TCP stays open but server stops responding.
+
+```toml
+ping_interval = 120   # silence before PING (seconds)
+ping_timeout = 30     # wait for PONG (seconds)
+```
+
+Total detection time: `ping_interval + ping_timeout` (default 150s).
+
+## server-time (IRCv3)
+
+Automatic -- no config needed. Timestamps injected on all messages.
+Backlog replay includes original timestamps.
+
+## Push Notifications
+
+```toml
+notify_url = "https://ntfy.sh/my-topic"   # ntfy or generic webhook
+notify_on_highlight = true                 # channel mentions
+notify_on_privmsg = true                   # private messages
+notify_cooldown = 60                       # rate limit (seconds)
+notify_proxy = false                       # use SOCKS5 for notifications
+```
+
+Only fires when no clients are attached.
+
 ## Config Skeleton
 
 ```toml
@@ -148,6 +176,9 @@ probation_seconds / nick_timeout / rejoin_delay
 backoff_steps / http_timeout
 email_poll_interval / email_max_polls / email_request_timeout
 cert_validity_days
+ping_interval / ping_timeout      # PING watchdog
+notify_url / notify_on_highlight / notify_on_privmsg
+notify_cooldown / notify_proxy    # push notifications
   [bouncer.backlog]
     max_messages / replay_on_connect
 
@@ -197,7 +228,8 @@ src/bouncer/
   cert.py        # client certificate generation + management
   captcha.py     # hCaptcha solver via NoCaptchaAI
   commands.py    # 25 bouncer control commands (/msg *bouncer)
-  router.py      # message routing + backlog trigger
+  notify.py      # push notifications (ntfy/webhook)
+  router.py      # message routing + backlog trigger + server-time
   server.py      # TCP listener
   backlog.py     # SQLite store/replay/prune
 ```