Discord: check bot permissions before handing a token to a node (server-26#225 S3)

start_stream now asks Discord (cached REST snapshots, S2) whether each bot
it could pick may View, Connect and Speak in the voice channel, before the
lease. Covers all four entry points: bot POST /discord/streams, web picker,
nodes discord_join, and the reconciler's re-place.

- pick_token: denied bots skipped; confirmed-ok sorts before unknown;
  unknown is allowed (fail open); all denied -> missing_permissions naming
  each bot, missing permission, trace reason and fix. The reuse branch
  falls through when its token is denied.
- Bounded: discord_perm_check_concurrency at once, within
  discord_perm_check_budget_seconds; unanswered = unknown.
- Non-voice channel -> 400 bad_channel (not missing_permissions).
- systems/{id}.preferred_token_id is now read (plan finding 1), as a hint.
- Pool bots at discord_pool_bot_guild_cap are never offered as invites;
  pool_full when nothing else is left (owner Q3).
- handle_actual drops cached access on missing_permissions, channel_full,
  not_in_guild, bad_channel.
- New GET /discord/nodes/{node_id}/guilds/{guild_id}/voice-check (org
  member, names only) and GET /discord/guilds/{guild_id}/voice-check
  (service key or admin).
- PUT /tokens/{id}/prefer/{system_id}: org owners for their own systems
  and own BYO bots; shared systems and pool bots stay admin-only (owner Q2).
  Keeps both pointers single-valued; audited.
- Kill switch: DISCORD_PERM_CHECK_ENABLED=false.
- tests/conftest.py: autouse fixture so no test ever reaches discord.com.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-c2-core/app/config.py

@@ -258,8 +258,10 @@ class Settings(BaseSettings):
 
     # --- Discord permission checks, REST client, OAuth linking (server-26#225)
     # Every setting the #225 slices use lives here, added once (S2).
-    # Kill switch (S3): False restores today's token picking exactly — no
-    # REST permission check before a bot is handed to a node.
+    # Kill switch (S3): False restores token picking without the REST
+    # permission check — no Discord call before a bot is handed to a node.
+    # (The system's preferred bot is still tried first either way: that is
+    # a separate fix, plan finding 1, and makes no Discord call.)
     discord_perm_check_enabled: bool = True
     # Cache lifetimes for per-(bot, server) results (app/internal/discord_rest.py):
     # a result that lets a bot in; denied / not-a-member / invalid token; and