Discord REST client, cache and #225 settings (server-26#225 S2)

New app/internal/discord_rest.py: one shared httpx client with the
DiscordBot User-Agent, per-token rate-limit buckets (X-RateLimit-Bucket +
guild), one retry on a 429 of <=3s, global-429 pause per token, and a
process-wide breaker at 4000 401/403/unshared-429 responses per 10 min so
C2 can never get the shared egress IP banned. Tokens are never logged.

inspect_token / refresh_membership / leave_guild / TokenRejected move off
discord_leases onto it. /users/@me/guilds now follows after= pages (it read
one page of 200 and silently dropped the rest); a failed page is unknown,
never a truncated list.

guild_snapshot(token_doc, guild_id): cached, single-flight read of
/guilds/{g}, the bot's own member and /channels for S3's permission check.
401 marks the token invalid; 10004/10007 drop the server from guild_ids;
50001 is confirmed with one membership read and never changes guild_ids
on its own. TTLs: ok 120s, not-member/invalid 600s, unknown 30s.

config.py gets every setting the #225 slices use (perm-check kill switch,
TTLs, breaker budget, OAuth redirect URI, discord_pool_bot_guild_cap=90).
No behaviour change beyond pagination, User-Agent and the breaker.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-c2-core/tests/test_discord_leases.py

@@ -13,6 +13,7 @@ from datetime import datetime, timezone, timedelta
 import pytest
 
 from app.internal import discord_leases as leases
+from app.internal import discord_rest
 from app.internal import discord_streams as streams
 from tests.fake_firestore import FakeFirestore
 
@@ -38,7 +39,7 @@ def fs(monkeypatch):
 
     async def _no_discord(token_ids):
         return 0
-    monkeypatch.setattr(leases, "refresh_membership", _no_discord)
+    monkeypatch.setattr(discord_rest, "refresh_membership", _no_discord)
     return fake