Discord: "Connect a Discord server" OAuth UI (server-26#225 S7)

- /discord/connected: Discord's OAuth redirect target. Stashes code/state
  in sessionStorage, strips them from the URL (replaceState), no-referrer
  (metadata + response header), sends a signed-out user to
  /login?next=/discord/connected and resumes, access_denied = "Nothing
  changed", result card "Linked X: N ready, M need a fix".
- middleware.ts: the callback path joins NO_SESSION_COOKIE_GATE (plan
  finding 2). Also needed for signed-in users: drb_session is
  SameSite=Strict, so it is not sent on the cross-site redirect back from
  discord.com.
- /login honours ?next= for an allowlist of one path (no open redirect).
- DiscordServersCard: Connect is the primary action with a radio-bot
  picker (automatic / the bot for a system / the org's own bots); the
  /drb link code moves to a collapsed secondary option and opens itself
  when /discord/oauth/start answers 404.
- RadioBotsPanel: write-only client-secret field per bot (PUT/DELETE
  /tokens/{id}/oauth), "Connect on/off", "N of 100 servers" with the
  pool cap (90) warning.
- lib/discordOAuth.ts: the S6 client, kept out of c2api.ts; only ever
  navigates to a discord.com /oauth2/authorize URL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-frontend/app/discord/connected/layout.tsx

@@ -0,0 +1,14 @@
+import type { Metadata } from "next";
+
+// The URL Discord sends the browser back to carries a single-use OAuth code.
+// The page strips it from the address bar on load; no-referrer (also set as a
+// response header in middleware.ts) covers anything that loads before that.
+export const metadata: Metadata = {
+  title: "Connect a Discord server",
+  referrer: "no-referrer",
+  robots: { index: false, follow: false },
+};
+
+export default function DiscordConnectedLayout({ children }: { children: React.ReactNode }) {
+  return children;
+}