Mitigate spam by soft-logging out spammy users.

### Your use case

#### What would you like to do?

If a user on your server is doing something spammy (e.g. inviting hundreds of users, or joining hundreds of rooms, or flooding) we should consider using soft-logout to force them to go through UI auth to prove they're human.

#### Why would you like to do it?

Make life harder for spammers.

#### How would you like to achieve it?

Soft logout.

### Have you considered any alternatives?

_No response_

### Additional context

_No response_

### Are you willing to provide a PR?

No