Move picker router/client additions off PR #218's lines (no merge conflict)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-c2-core/app/main.py

@@ -20,9 +20,9 @@ from app.internal.auth import (
 from app.routers import nodes, systems, calls, upload, tokens, incidents, alerts, admin, trips, places, links, users
 from app.routers import enrollment, media, org, waitlist, telemetry, replay, traffic, cameras
 from app.routers import discord as discord_router
-from app.routers import discord_web
 from app.internal import dynsec
 from app.internal import firestore as fstore
+from app.routers import discord_web
 
 
 async def _clear_legacy_token_flags():
@@ -156,12 +156,12 @@ app.include_router(waitlist.router)    # public — no auth, source-IP rate limi
 # public by necessity — an <audio src> can't send a bearer token, so the
 # short-lived HMAC in the URL is the credential. Checked inline in media.py.
 app.include_router(media.router)
-# auth is per-endpoint: bot routes take the service key (or a platform admin);
-# the token-fetch route takes the calling node's own API key.
-app.include_router(discord_router.router)
 # auth is per-endpoint: directory push takes the service key; the node-page
 # picker takes a Firebase token scoped to the node's org (server-26#213).
 app.include_router(discord_web.router)
+# auth is per-endpoint: bot routes take the service key (or a platform admin);
+# the token-fetch route takes the calling node's own API key.
+app.include_router(discord_router.router)
 # NOTE: there used to be an app.routers.mqtt_auth router here (an HTTP
 # backend for the mosquitto-go-auth plugin). That plugin's upstream project
 # is archived (no CVE patches) and was rejected for an internet-facing