fix #2135

* fix #2133

Don't record NICK and QUIT in history for invisible auditorium members

Handling of reserved nicknames is special-cased due to #1594, but we want to send
ERR_NICKNAMEINUSE if the nickname is actually in use, since that doesn't pose any
client compatibility problems.

* fix #2129

Don't print the values of environment variable overrides, just the keys

* fix unit tests

fix #2130

We load registered channels unconditionally; reloading them again on rehash
is incorrect. This caused buggy behavior when channel registration was
disabled in the config, but some registered channels were already loaded.

* Gracefully handle NS cert add myself <fp>

A non-operator with the nick "mynick" attempts to register
a fingerprint to their authenticated account.

They /msg NickServ cert add mynick <fingerprint>

NickServ responds with "Insufficient privileges" because
they've accidentally invoked the operator syntax (to action
other accounts).

This patch allows the user to add the fingerprint if the client's
account is identical to the target account.

Signed-off-by: Matt Hamilton <m@tthamilton.com>

* Update nickserv.go

Compare the case-normalized target to Account()

---------

Signed-off-by: Matt Hamilton <m@tthamilton.com>
Co-authored-by: Shivaram Lingamneni <slingamn@cs.stanford.edu>

* implement SASL OAUTHBEARER and draft/bearer
* Upgrade JWT lib
* Fix an edge case in SASL EXTERNAL
* Accept longer SASL responses
* review fix: allow multiple token definitions
* enhance tests
* use SASL utilities from irc-go
* test expired tokens

pull out max parameters constant in isupport impl

upgrade to go 1.22

fix #2123

Add a configurable limit on realname length

* Add caddy reverse proxy websocket example

* Use consistent hostname for caddy reverse proxy

* Explain reverse proxy setup for websockets

* Update MANUAL.md

Clarify that we only support `X-Forwarded-For`

---------

Co-authored-by: Shivaram Lingamneni <slingamn@cs.stanford.edu>

bump version and changelog for 2.13.0-rc1

add panic handler to async client/channel writes

See #2113 for motivation

fix #2114

Channels with slashes (or other relaymsg separators) in their names
were being falsely detected as relaymsg identifiers.

fix #2113

Persisting always-on clients was panicking if client X believed it was
a member of channel Y, but channel Y didn't have a record of client X.

Remove numerics associated with the retired ACC spec

fix #2108

Bump golang.org/x/crypto from 0.5.0 to 0.17.0

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.5.0 to 0.17.0.
- [Commits](https://github.com/golang/crypto/compare/v0.5.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

include a fixed test vector in password tests

Send Message-ID even if DKIM is not enabled, for compatibility with Gmail:

* A workaround for Ergo 2.12.0 is to enable DKIM
* You need to enable either DKIM or SPF (preferably both) to send to Gmail anyway
* You also need forward-confirmed reverse DNS, which can be tricky for IPv6...

* bump docker base image to alpine 3.19

Fixes #2103

add `init: true` to docker-compose.yml

Follows up from #2096, #2097

* add --init to suggested docker run invocations

See #2096; this should fix unreaped zombies when using an auth-script or
ip-check-script that spawns its own subprocesses, then exits before reaping
them.

* add a note on why --init