Add anti-raid and anti-nuke protection

Join Gate (account age, avatar, advertising and username filters, bot
checks), raid detection with invite pausing, anti-nuke quarantine of
admins who mass delete, manual and automatic lockdowns, a decaying heat
score against spam, role and channel snapshots with restore, and alert
DMs to the owner and trusted users. Everything that weakens protection
is limited to the owner and the trusted list.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -10,6 +10,7 @@ It currently includes:
 - Scheduling (1:1 sessions with DM invites + reaction-based accept/decline/reschedule)
 - Projects (list/create projects + helpers)
 - Support tickets (a panel with categories, a private thread per ticket, claim/close, transcripts to a log channel)
+- Anti-raid and anti-nuke (Join Gate, raid mode, quarantine of anyone who mass-deletes or mass-bans, lockdowns), modelled on Wick
 - Music (Lavalink-powered `/play`, `/queue`, `/volume`)
 - Twitch live notifications (per-guild `/config` setup)
 - Welcome messages, DMs, and default role assignment (per-guild `/config` setup)
@@ -105,6 +106,18 @@ just down    # stop postgres
   - `/tickets panel` — Post or refresh the panel (**Manage Server**)
   - `/ticket add`, `/ticket close [reason]` — Opener or staff; `/ticket claim`, `/ticket remove` — staff
   - The bot needs View Channel, Send Messages, Embed Links, Create Private Threads, Send Messages in Threads and Manage Threads in the ticket channel, and Attach Files in the log channel. Give the staff role Manage Threads there too, so staff see every ticket.
+- **Security** (anti-raid and anti-nuke; everything is off until turned on)
+  - `/security status`, `/security toggle feature on`, `/security alerts channel [role]`
+  - `/security trust add|remove user|role` — owner only; trusted members are exempt from anti-nuke and may change security settings
+  - `/security release user`, `/security quarantined`, `/security end-raid`, `/security quarantine-role`
+  - `/lockdown channel|server|joins`, `/unlock channel|server|joins` — unlocking needs the owner or a trusted member
+  - `/security snapshot`, `/security restore` — snapshots of roles and channels are also taken every 6 hours while anti-nuke is on (last three kept); restore recreates deleted roles and channels and reverts dangerous permission changes, and can run automatically after a stopped nuke
+  - Heat (anti-spam): messages build a per-member score that cools over time; spam, repeats, mass mentions and invite links max it, which deletes the message and times the member out (doubling for repeat offences). A wave of spammers turns on heat panic (newcomers timed out on sight for 10 minutes); a mention flood can lock the server. Moderators (Manage Messages) and trusted members are exempt.
+  - Raid mode survives a bot restart.
+  - Critical alerts (raids, stopped nukes, restores, spam waves, removed bots) are also DMed to the owner and trusted users (up to 10; trusted roles aren't expanded), since the alert channel may be the first thing a nuker deletes. One setting turns this off.
+  - Join Gate filters, raid thresholds, anti-nuke limits and heat settings are set on the dashboard.
+  - The bot needs View Audit Log, Manage Roles, Manage Channels, Manage Server (to pause invites), Moderate Members, Kick Members and Ban Members, and its role must be above the roles it protects against: it can only quarantine members whose highest role is below its own.
+  - Turning things off, unlocking and releasing always need the owner or someone on the trusted list, whatever Discord's command permissions say.
 - **Music** (requires **DJ** role)
   - `/play`, `/queue`, `/volume`
 - **Moderation** (focused + practical)