fix: address 3 blocking review findings for IRC protocol listener

1. ISUPPORT/applyChannelModes: extend IRC MODE handler to support +i/-i,
   +s/-s, +n/-n (routed through svc.SetChannelFlag), and +H/-H (hashcash
   bits with parameter parsing). Add 'n' (no external messages) as a
   proper DB-backed channel flag with is_no_external column (default: on).
   Update IRC ISUPPORT to CHANMODES=,,H,imnst to match actual support.

2. QueryChannelMode: rewrite to return complete mode string including all
   boolean flags (n, i, m, s, t) and parameterized modes (k, l, H),
   matching the HTTP handler's buildChannelModeString logic. Simplify
   buildChannelModeString to delegate to QueryChannelMode for consistency.

3. Service struct encapsulation: change exported fields (DB, Broker,
   Config, Log) to unexported (db, broker, config, log). Add NewTestService
   constructor for use by external test packages. Update ircserver
   export_test.go to use the new constructor.

Closes #89

internal/db/queries.go

@@ -2165,6 +2165,52 @@ func (database *Database) SetChannelSecret(
 	return nil
 }
 
+// --- No External Messages (+n) ---
+
+// IsChannelNoExternal checks if a channel has +n mode.
+func (database *Database) IsChannelNoExternal(
+	ctx context.Context,
+	channelID int64,
+) (bool, error) {
+	var isNoExternal int
+
+	err := database.conn.QueryRowContext(ctx,
+		`SELECT is_no_external FROM channels
+		 WHERE id = ?`,
+		channelID,
+	).Scan(&isNoExternal)
+	if err != nil {
+		return false, fmt.Errorf(
+			"check no external: %w", err,
+		)
+	}
+
+	return isNoExternal != 0, nil
+}
+
+// SetChannelNoExternal sets or unsets +n mode.
+func (database *Database) SetChannelNoExternal(
+	ctx context.Context,
+	channelID int64,
+	noExternal bool,
+) error {
+	val := 0
+	if noExternal {
+		val = 1
+	}
+
+	_, err := database.conn.ExecContext(ctx,
+		`UPDATE channels
+		 SET is_no_external = ?, updated_at = ?
+		 WHERE id = ?`,
+		val, time.Now(), channelID)
+	if err != nil {
+		return fmt.Errorf("set no external: %w", err)
+	}
+
+	return nil
+}
+
 // ListAllChannelsWithCountsFiltered returns all channels
 // with member counts, excluding secret channels that
 // the given session is not a member of.