feat: add --llm mode for LLM-friendly stdout filtering

Split output when running with --llm: addressed messages from owners
go to stdout, everything else (chatter, logs, plugin loads) goes to
info.log. Adds owner privilege level (superset of admin) for gating
LLM access. Status lines (connect, ping, disconnect, reconnect) and
bot replies also appear on stdout for session awareness.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/USAGE.md

@@ -16,6 +16,7 @@ derp --config /path/to/derp.toml --verbose
 |------|-------------|
 | `-c, --config PATH` | Config file path |
 | `-v, --verbose` | Debug logging |
+| `--llm` | LLM mode: addressed messages to stdout, rest to info.log |
 | `--cprofile [PATH]` | Enable cProfile, dump to PATH [derp.prof] |
 | `--tracemalloc [N]` | Enable tracemalloc, capture N frames deep [10] |
 | `-V, --version` | Print version |
@@ -51,6 +52,7 @@ plugins_dir = "plugins"       # Plugin directory path
 rate_limit = 2.0              # Max messages per second (default: 2.0)
 rate_burst = 5                # Burst capacity (default: 5)
 paste_threshold = 4           # Max lines before overflow to FlaskPaste (default: 4)
+owner = []                    # Owner hostmask patterns (fnmatch), grants admin + LLM access
 admins = []                   # Hostmask patterns (fnmatch), IRCOPs auto-detected
 timezone = "UTC"              # Timezone for calendar reminders (IANA tz name)
 
@@ -216,14 +218,20 @@ Default format is `"text"` (human-readable, same as before).
 
 ## Admin System
 
-Commands marked as `admin` require elevated permissions. Admin access is
-granted via:
+Commands marked as `admin` require elevated permissions. There are two
+privilege levels:
 
-1. **IRC operator status** -- detected automatically via `WHO`
-2. **Hostmask patterns** -- configured in `[bot] admins`, fnmatch-style
+| Level | Source | Grants |
+|-------|--------|--------|
+| **Owner** | `[bot] owner` hostmask patterns | Admin + LLM mode access |
+| **Admin** | `[bot] admins` patterns, IRC operators | Admin commands only |
+
+Owner is a superset of admin -- owners automatically have admin privileges.
+Only owners can interact with the bot via `--llm` mode.
 
 ```toml
 [bot]
+owner = ["me!~user@my.host"]
 admins = [
     "*!~user@trusted.host",
     "ops!*@*.ops.net",
@@ -368,7 +376,7 @@ The script is cron-friendly (exit 0/1, quiet unless `NO_COLOR` is unset).
 ```
 data/
   GeoLite2-City.mmdb    # MaxMind GeoIP (requires license key)
-  GeoLite2-ASN.mmdb     # MaxMind ASN (requires license key)
+  ip2asn-v4.tsv         # iptoasn.com ASN database (no key required)
   tor-exit-nodes.txt    # Tor exit node IPs
   iprep/                # Firehol/ET blocklist feeds
     firehol_level1.netset
@@ -380,7 +388,8 @@ data/
     ...
 ```
 
-GeoLite2 databases require a free MaxMind license key. Set
+The ASN database is downloaded from iptoasn.com (no account required).
+GeoLite2-City requires a free MaxMind license key -- set
 `MAXMIND_LICENSE_KEY` when running the update script.
 
 ## Plugin Management
@@ -488,6 +497,39 @@ On connection loss, the bot reconnects with exponential backoff and jitter:
 - Jitter: +/- 25% to avoid thundering herd
 - Resets to 5s after a successful connection
 
+## LLM Mode
+
+Run with `--llm` to split output for LLM consumption. All internal logging
+(connection status, plugin loads, unaddressed chatter) goes to `info.log`.
+Stdout receives only messages addressed to the bot and the bot's own replies.
+
+```bash
+derp --llm
+derp --llm --config config/derp.toml
+```
+
+### What goes to stdout
+
+- **DMs**: private messages from an owner
+- **Nick-prefixed**: channel messages from an owner starting with `<botnick>:` or `<botnick>,`
+- **Bot replies**: all messages sent by the bot (PRIVMSG and ACTION)
+- **Status lines**: connection, ping, disconnect, reconnect events
+
+### Output format
+
+```
+19:09 --- connected as derp
+19:09 --- ping
+19:09 #test <alice> derp: what is 1.1.1.1?
+19:09 #test <derp> 1.1.1.1: AS13335 CLOUDFLARENET (US)
+19:09 <bob> hey derp, check this out
+19:09 <derp> I'm just a bot
+19:09 #test * derp [rss/hackernews] New article -- URL
+19:15 --- disconnected: Connection reset
+19:15 --- reconnecting in 5s
+19:15 --- connected as derp
+```
+
 ### `!dork` -- Google Dork Query Builder
 
 Generate Google dork queries for a target domain. Template-based, no HTTP