feat: add admin/owner permission system

Hostmask-based admin controls with automatic IRCOP detection via WHO.
Permission enforcement in the central dispatch path denies restricted
commands to non-admins. Includes !whoami and !admins commands, marks
load/reload/unload as admin-only.

Also lands previously-implemented SASL PLAIN auth, token-bucket rate
limiting, and CTCP VERSION/TIME/PING responses that were staged but
uncommitted.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -8,5 +8,4 @@ services:
     volumes:
       - ./config/derp.toml:/app/config/derp.toml:ro,Z
       - ./plugins:/app/plugins:ro,Z
-      - ./profile:/app/profile:Z
-    command: ["--verbose", "--cprofile", "/app/profile/derp.prof"]
+    command: ["--verbose"]