feat: add webhook auth guard and IRC password/username support

Add WEBHOOK_SECRET env var for authenticating incoming Owncast webhooks
via a ?secret= query parameter. Requests with a missing or incorrect
secret are rejected with 401. If unset, all requests are accepted
(with a startup warning).

Also includes previously uncommitted work:
- IRC server password support (IRC_PASSWORD env var, PASS command)
- IRC username/ident field in config
- IRC_PASSWORD and SELinux volume flag in docker-compose.yml

Made-with: Cursor

chat-summaries/2026-03-12_22-00-summary.md

@@ -0,0 +1,17 @@
+# IRC Server Password Support
+
+## Task
+Add support for connecting to password-protected IRC servers by sending the PASS command during connection, and allow setting a custom IRC username.
+
+## Changes
+
+- **src/config.rs**: Added `username: Option<String>` field to `IrcConfig`. Added `BridgeConfig::irc_server_password()` method that reads `IRC_PASSWORD` from the environment (returns `Option<String>`). Updated `default_for_test()` and tests for the new field and method.
+- **src/irc_task.rs**: Set `password` and `username` on the `irc` crate's `Config` when building the IRC connection, sourcing the password from `BridgeConfig::irc_server_password()` and username from `IrcConfig.username`.
+- **config.toml**: Removed stale `server_password` field, added comment about `IRC_PASSWORD` env var.
+- **config.example.toml**: Added commented-out `username` field and `IRC_PASSWORD` env var documentation.
+
+## Usage
+Set the `IRC_PASSWORD` environment variable before running the bridge to authenticate with the IRC server. Optionally set `username` in `[irc]` config for a custom ident.
+
+## Follow-up
+- None identified.