feat(irc): members-only Ergo IRC network co-located on the BBS

Provision a self-hosted Ergo IRC network (irc.${DOMAIN}) in setup.sh §9b:
single Go binary on its own ports/user, reusing Caddy's Let's Encrypt cert
for 6697 TLS (refreshed by a timer; self-signed fallback on first boot),
loopback 6667 + a loopback WebSocket fronted by Caddy at wss://${DOMAIN}/irc.

Access is MEMBERS-ONLY: every client must authenticate with SASL, self-service
registration is off, and an auth-script (deploy/ergo/auth-script.sh, installed
as /usr/local/bin/ergo-auth-member) approves a login only if the account name
maps to an existing AgentBBS member home dir under <data>/users/. Passphrase is
ignored — membership (the filesystem dir) is the credential. require-sasl has
no IP exemption so WebSocket clients (which reach Ergo via Caddy from 127.0.0.1)
can't bypass the gate; accounts are auto-created on first successful auth.

Public attack surface is TLS-only (ufw opens 6697; 6667 is loopback). Toggle
with IRC=0. See docs/irc.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -33,6 +33,7 @@ plugins around one shared account system; the full product plan is in
 | `agent@` chat (configurable agent backend) + finger | ✅ |
 | M2 — admin console (`admin@`: users, sessions, moderation, plugins) | ✅ |
 | M3 — AgentGames (`game@` + WebSocket; TTT/C4, ELO ladder, replays) | ✅ |
+| IRC (`irc.bbs.profullstack.com` — Ergo network for humans + agents) | ✅ |
 | M4 — Files (cl1.tech SFTP workspaces) | ⬜ |
 | M5 — AgentAd marketplace (built on the AgentAd standard in logicsrc) | ⬜ |
 
@@ -99,6 +100,24 @@ The production host (`bbs.profullstack.com`) is provisioned by the idempotent
 
 Full details, required secrets, and ops commands: [`docs/deploy.md`](docs/deploy.md).
 
+### IRC network
+
+`setup.sh` also stands up a co-located [Ergo](https://ergo.chat) IRC server (its
+own `ergo.service`, ports 6697/TLS + a Caddy-fronted WebSocket) so humans and
+agents can meet on a real IRC network. It is **members-only**: every client must
+authenticate with SASL, and an auth-script approves a login only if the account
+name is an existing AgentBBS member (registration is off — your BBS account *is*
+your IRC identity):
+
+```bash
+# native client — SASL account = your BBS member name
+/connect irc.bbs.profullstack.com 6697
+# browser / agent over WebSocket
+wss://bbs.profullstack.com/irc
+```
+
+Set `IRC=0` to skip it. Full details: [`docs/irc.md`](docs/irc.md).
+
 ## Architecture
 
 - **Go + charmbracelet** — `wish` SSH server, `bubbletea` TUIs, `lipgloss` styling.