feat: add traditional IRC wire protocol listener on configurable port

Add a backward-compatible IRC protocol listener (RFC 1459/2812) that
allows standard IRC clients (irssi, weechat, hexchat, etc.) to connect
directly via TCP.

Key features:
- TCP listener on configurable port (IRC_LISTEN_ADDR env var, e.g. :6667)
- Full IRC wire protocol parsing and formatting
- Connection registration (NICK + USER + optional PASS)
- Channel operations: JOIN, PART, MODE, TOPIC, NAMES, LIST, KICK, INVITE
- Messaging: PRIVMSG, NOTICE (channel and direct)
- Info commands: WHO, WHOIS, LUSERS, MOTD, AWAY
- Operator support: OPER (with configured credentials)
- PING/PONG keepalive
- CAP negotiation (for modern client compatibility)
- Full bridge to HTTP/JSON API (shared DB, broker, sessions)
- Real-time message relay via broker notifications
- Comprehensive test suite (parser + integration tests)

The IRC listener is an optional component — disabled when IRC_LISTEN_ADDR
is empty (the default). The Broker is now an Fx-provided dependency shared
between HTTP handlers and the IRC server.

closes #89

README.md

@@ -27,6 +27,7 @@ web client as a convenience/reference implementation, but the API comes first.
 - [Federation](#federation-server-to-server)
 - [Storage](#storage)
 - [Configuration](#configuration)
+- [IRC Protocol Listener](#irc-protocol-listener)
 - [Deployment](#deployment)
 - [Client Development Guide](#client-development-guide)
 - [Rate Limiting & Abuse Prevention](#rate-limiting--abuse-prevention)
@@ -2227,6 +2228,7 @@ directory is also loaded automatically via
 | `NEOIRC_OPER_PASSWORD` | string | `""`                              | Server operator (o-line) password. Both name and password must be set to enable OPER. |
 | `LOGIN_RATE_LIMIT` | float   | `1`                                  | Allowed login attempts per second per IP address. |
 | `LOGIN_RATE_BURST`  | int    | `5`                                  | Maximum burst of login attempts per IP before rate limiting kicks in. |
+| `IRC_LISTEN_ADDR`  | string  | `""`                                 | TCP address for the traditional IRC protocol listener (e.g. `:6667`). Disabled if empty. |
 | `MAINTENANCE_MODE` | bool    | `false`                              | Maintenance mode flag (reserved) |
 
 ### Example `.env` file
@@ -2243,6 +2245,71 @@ NEOIRC_HASHCASH_BITS=20
 
 ---
 
+## IRC Protocol Listener
+
+neoirc includes an optional traditional IRC wire protocol listener (RFC
+1459/2812) that allows standard IRC clients to connect directly. This enables
+backward compatibility with existing IRC clients like irssi, weechat, hexchat,
+and others.
+
+### Enabling
+
+Set the `IRC_LISTEN_ADDR` environment variable to a TCP address:
+
+```bash
+IRC_LISTEN_ADDR=:6667
+```
+
+When unset or empty, the IRC listener is disabled and only the HTTP/JSON API is
+available.
+
+### Supported Commands
+
+| Category   | Commands                                             |
+|------------|------------------------------------------------------|
+| Connection | `NICK`, `USER`, `PASS`, `QUIT`, `PING`/`PONG`, `CAP` |
+| Channels   | `JOIN`, `PART`, `MODE`, `TOPIC`, `NAMES`, `LIST`, `KICK`, `INVITE` |
+| Messaging  | `PRIVMSG`, `NOTICE`                                  |
+| Info       | `WHO`, `WHOIS`, `LUSERS`, `MOTD`, `AWAY`             |
+| Operator   | `OPER` (requires `NEOIRC_OPER_NAME` and `NEOIRC_OPER_PASSWORD`) |
+
+### Protocol Details
+
+- **Wire format**: CR-LF delimited lines, max 512 bytes per line
+- **Connection registration**: Clients must send `NICK` and `USER` to register.
+  An optional `PASS` before registration sets the session password (minimum 8
+  characters).
+- **CAP negotiation**: `CAP LS` and `CAP END` are silently handled for
+  compatibility with modern clients. No capabilities are advertised.
+- **Channel prefixes**: Channels must start with `#`. If omitted, it's
+  automatically prepended.
+- **First joiner**: The first user to join a channel is automatically granted
+  operator status (`@`).
+- **Channel modes**: `+m` (moderated), `+t` (topic lock), `+o` (operator),
+  `+v` (voice)
+
+### Bridge to HTTP API
+
+Messages sent by IRC clients appear in channels visible to HTTP/JSON API
+clients and vice versa. The IRC listener and HTTP API share the same database,
+broker, and session infrastructure. A user connected via IRC and a user
+connected via the HTTP API can communicate in the same channels seamlessly.
+
+### Docker Usage
+
+To expose the IRC port in Docker:
+
+```bash
+docker run -d \
+  -p 8080:8080 \
+  -p 6667:6667 \
+  -e IRC_LISTEN_ADDR=:6667 \
+  -v neoirc-data:/var/lib/neoirc \
+  neoirc
+```
+
+---
+
 ## Deployment
 
 ### Docker (Recommended)