feat: add wave 4 plugins (opslog, note, subdomain, headers)

Opslog: timestamped operational log per channel with add, list,
search, and delete. SQLite-backed, admin-only clear.

Note: persistent per-channel key-value store with set, get, del,
list, clear. SQLite-backed, admin-only clear.

Subdomain: enumeration via crt.sh CT log query with optional DNS
brute force using a built-in 80-word prefix wordlist. Resolves
discovered subdomains concurrently.

Headers: HTTP header fingerprinting against 50+ signature patterns.
Detects servers, frameworks, CDNs, and security headers (HSTS, CSP,
XFO, etc).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -55,6 +55,10 @@ make down      # Stop
 | torcheck | tor | Tor exit node check (local list) |
 | iprep | iprep | IP reputation (Firehol/ET blocklists) |
 | cve | cve | CVE lookup + search (local NVD mirror) |
+| opslog | opslog | Timestamped operational notes (SQLite) |
+| note | note | Per-channel persistent key-value store |
+| subdomain | subdomain | Subdomain enum (crt.sh + DNS brute) |
+| headers | headers | HTTP header fingerprinting |
 | example | echo | Demo plugin |
 
 ## Writing Plugins