Give Tor clients who authenticate via SASL a unique cloak, so chanops
can ban *!*@tor-network.onion and still allow authenticated Tor users

HELP responses weren't taking the client nickname as a parameter,
as is standard.

Fixes #810

1. Consolidate PURGE and UNPURGE into subcommands
2. Add PURGE LIST
3. PURGE ADD now requires a confirmation code

Fixes #1294

Channel rename (both of registered and unregistered channels) would leave
the old name unreclaimable.

Fixes #1260

INVITE playback (#1409) was buggy, due to the double use of (Item).Params[0]
for the channel name and the recipient nick. Stuff the channel name in
(Item).Message.Message instead.

This didn't work correctly for IPv6 or custom nets.
/UNDLINE IP can temporarily be used to reset the throttle.

Validate imported databases for confusable nicks

Tor listeners should never see an STS cap.

Add an undocumented 'hide-sts' key for listeners that hides the STS cap.
This can be used if the listener is secured at layer 3 or 4 (VPNs,
E2E mixnets). It will be necessary to add the relevant IPs to `secure-nets`.

Allow custom limit definitions that encompass multiple subnets

Convert the flat list of channels for always-on clients
to a map from channel names to channel-user modes.

Store the channel-user modes of always-on clients along with their
channel memberships, restore them on server startup. This will coexist
alongside /CS AMODE, which autoapplies modes to clients on join regardless
of their always-on status.

Allow `JOIN 0` with a confirmation code

Record INVITE in DM history for the benefit of offline always-on clients

* Defer account login snomask until after connection registration is complete
* Don't send account-notify for pre-registration clients

Clients without event-playback should receive client-only tags in
replayed PRIVMSG / NOTICE.

Fixes #1407

Instead of building a new serialized message for each recipient,
try to cache them.

Resuming clients without the resume capability would receive
two JOIN lines per channel.

Support PROXY protocol v2, including ahead of plaintext connections

NS SUSPEND DEL incorrectly required the use of the casefolded account name.

Fixes #1380