docs: document channel config and structured logging

Add per-channel plugin control and JSON logging sections to USAGE.md,
CHEATSHEET.md, and derp.toml.example. Mark items done in ROADMAP.md.

docs/USAGE.md

@@ -53,6 +53,7 @@ admins = []                   # Hostmask patterns (fnmatch), IRCOPs auto-detecte
 
 [logging]
 level = "info"                # Logging level: debug, info, warning, error
+format = "text"               # Log format: "text" (default) or "json"
 ```
 
 ## Built-in Commands
@@ -147,6 +148,49 @@ broken.test -- error: timeout
 - crt.sh can be slow; the bot confirms receipt before querying
 - Live cert check runs only when expired CT entries exist
 
+## Per-Channel Plugin Control
+
+Restrict which plugins are active in specific channels. Channels without
+a `[channels."<name>"]` section run all plugins. Channels with a `plugins`
+list only run those plugins. The `core` plugin is always active (exempt
+from filtering). Private messages are always unrestricted.
+
+```toml
+[channels."#public"]
+plugins = ["core", "dns", "cidr", "encode"]
+
+[channels."#ops"]
+plugins = ["core", "revshell", "payload", "exploitdb", "opslog"]
+
+# #unrestricted -- no section, runs everything
+```
+
+When a command is denied by channel config, it is silently ignored (no
+error message). Event handlers from denied plugins are also skipped.
+
+## Structured Logging (JSON)
+
+Set `format = "json"` in `[logging]` to emit one JSON object per log line
+(JSONL), suitable for log aggregation tools.
+
+```toml
+[logging]
+level = "info"
+format = "json"
+```
+
+Each line contains:
+
+| Field | Description |
+|-------|-------------|
+| `ts` | Timestamp (`YYYY-MM-DDTHH:MM:SS`) |
+| `level` | Log level (`debug`, `info`, `warning`, `error`) |
+| `logger` | Logger name (`derp.bot`, `derp.plugin`, etc.) |
+| `msg` | Log message text |
+| `exc` | Exception traceback (only present on errors) |
+
+Default format is `"text"` (human-readable, same as before).
+
 ## Admin System
 
 Commands marked as `admin` require elevated permissions. Admin access is