feat(discord): self-serve server->org linking with /drb link (#213 item 1)

- c2-core: POST /discord/link-codes (org owner/admin) mints a single-use,
  10-minute code; minting revokes the org's older codes. The bot redeems it
  via POST /discord/guilds/{id}/link/redeem (service key) inside one
  Firestore transaction, so two servers racing for one code cannot both win
  and a server linked to org A refuses org B's code. GET/DELETE
  /discord/linked-guilds lists/unlinks the caller's org's servers; unlink
  stops that server's streams. Rate-limited (mint per user, redeem per
  server and per Discord user); every mint/link/refusal/unlink audited.
- resolve_guild_org: an explicitly unlinked server no longer falls back to
  DISCORD_UNLINKED_GUILD_ORG_ID. Linking away from the fallback org stops
  the streams it had running for that org.
- Discord bot: /drb link code: (Manage Server, enforced at runtime too);
  GatedTree answers every other command in an unlinked server with how to
  link (autocomplete returns nothing). With the default fallback org set,
  nothing is gated — unchanged behaviour.
- Frontend: "Linked Discord servers" card on Settings -> Organization —
  generate code with countdown + copy, polls for the new link, unlink.
- 16 tests: single-use, two-server race, one-server/two-org race, expiry,
  revoked/malformed codes, wrong-org takeover, idempotent relink, rate
  limits, fallback stop, scoped list, unlink without fallback.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-frontend/lib/c2api.ts

@@ -384,6 +384,24 @@ export const c2api = {
   revokeEnrollmentToken: (tokenId: string) =>
     request(`/org/enrollment-tokens/${tokenId}`, { method: "DELETE" }),
 
+  // Discord server ↔ org linking (server-26#213). Owner mints a single-use
+  // code; someone with Manage Server redeems it with /drb link in Discord.
+  createDiscordLinkCode: () =>
+    request<{ code: string; expires_at: string; expires_minutes: number; command: string }>(
+      "/discord/link-codes",
+      { method: "POST" }
+    ),
+  listLinkedDiscordGuilds: () =>
+    request<{
+      guilds: { guild_id: string; guild_name: string | null; linked_at: string | null; linked_via: string }[];
+      unlinked_guilds_restricted: boolean;
+    }>("/discord/linked-guilds"),
+  unlinkDiscordGuild: (guildId: string) =>
+    request<{ ok: boolean; guild_id: string; streams_stopped: number }>(
+      `/discord/linked-guilds/${encodeURIComponent(guildId)}`,
+      { method: "DELETE" }
+    ),
+
   // 511NY cameras/events inside a map bbox (server-26#183)
   get511: (bbox: { south: number; west: number; north: number; east: number }, layers: string) =>
     request<Ny511Response>(`/traffic/511?${new URLSearchParams({