fix: block direct NICK from clients, require bouncer command

Clients sending /nick are intercepted with a NOTICE pointing them
to /msg *bouncer NICK <network> <nick> instead. Prevents unmanaged
nick changes that bypass the bouncer's identity tracking.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/bouncer/client.py

@@ -112,6 +112,15 @@ class Client:
         if msg.command == "QUIT":
             return
 
+        # Block direct NICK -- must go through /msg *bouncer NICK <network> <nick>
+        if msg.command == "NICK":
+            self._send_msg(IRCMessage(
+                command="NOTICE",
+                params=[self._nick, "Use /msg *bouncer NICK <network> <nick>"],
+                prefix="*bouncer!bouncer@bouncer",
+            ))
+            return
+
         # Intercept bouncer control commands
         if msg.command == "PRIVMSG" and len(msg.params) >= 2:
             target = msg.params[0].lower()