Discord radio channels: wire leases + desired-state streams (server-26#203, #204)

c2-core
- discord_streams/discord_leases wired in: POST /discord/streams,
  POST /discord/guilds/{id}/stop, GET /discord/guilds/{id}/overview,
  GET /discord/streams/{id}, PUT /discord/guilds/{id}/link (admin),
  GET /discord/node/{node}/tokens/{id} (node key, lease holder only).
- Retained nodes/{id}/discord/desired (token ids, never token strings),
  nodes/+/discord/actual subscribed and handled; per-node publish lock keeps
  the retained list the newest; failed publishes retried by the reconciler.
- Tokens freed only after the node acks logout (or offline past
  discord_lease_offline_release_seconds) - sweeper and C2 startup no longer
  release leases.
- /nodes/{id}/command discord_join/leave map onto streams; CommandPayload
  keeps preferred_token_id. /tokens: admin-only list, validate on add against
  Discord, refresh, flush via transactional force release.
- Guild -> org via discord_guilds, unlinked guilds fall back to
  DISCORD_UNLINKED_GUILD_ORG_ID (default "founding").
- tests/fake_firestore.py: optimistic-transaction fake; 27 lease/race tests.

discord bot
- /join, /leave, /status, autocomplete scoped to the calling guild; /leave
  never touches another server; Manage Channels default permission;
  /join edits its reply with the node's real result; /help copy fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-c2-core/app/internal/node_sweeper.py

@@ -53,8 +53,11 @@ async def _sweep():
             node_id = node.get("node_id")
             await fstore.doc_update("nodes", node_id, {"status": "offline"})
             logger.info(f"Node {node_id} marked offline (last seen: {last_seen.isoformat()})")
-            from app.routers.tokens import release_token
-            await release_token(node_id)
+            # Radio-bot tokens are NOT freed here any more (node-26#25): the
+            # node may still be logged in to Discord on them. The Discord
+            # reconciler (internal/discord_streams.py) frees them once the node
+            # has been offline past discord_lease_offline_release_seconds — by
+            # which point the edge has logged its bots out by itself.
             continue
 
         # Check for expired system overrides (only for fixed nodes with timeout enforced)