feat: add webhook auth guard and IRC password/username support

Add WEBHOOK_SECRET env var for authenticating incoming Owncast webhooks
via a ?secret= query parameter. Requests with a missing or incorrect
secret are rejected with 401. If unset, all requests are accepted
(with a startup warning).

Also includes previously uncommitted work:
- IRC server password support (IRC_PASSWORD env var, PASS command)
- IRC username/ident field in config
- IRC_PASSWORD and SELinux volume flag in docker-compose.yml

Made-with: Cursor

config.example.toml

@@ -1,5 +1,7 @@
 [irc]
 server = "irc.zeronode.net"
+# Set IRC_PASSWORD env var for server password (PASS command)
+# username = "myuser"
 port = 6667
 tls = false
 nick = "owncast-bridge"
@@ -8,6 +10,7 @@ channel = "#BowlAfterBowl"
 [owncast]
 url = "https://owncast.bowlafterbowl.com"
 # Set OWNCAST_ACCESS_TOKEN env var for the token
+# Set WEBHOOK_SECRET env var to require ?secret=<token> on incoming webhooks
 webhook_port = 9078
 websocket_enabled = true
 health_poll_interval_secs = 30