Centralize Discord control setup

[gholtzap]

Summary

This change prepares Hydra's Discord control flow for a centralized Discord app and relay setup.

• Hardens Discord interaction verification, request parsing, relay token validation, and slash command registration for guild installs.
• Separates Worker-local setup commands from relay-dispatched desktop commands so /hydra link cannot cross into the desktop command channel.
• Adds a Discord install action in Hydra Settings so users can open the official guild-install app URL from the configured auth service.
• Adds short-lived Discord link codes so users can bind a Discord channel/user to their signed-in Hydra desktop with /hydra link instead of manually copying server and channel IDs.
• Detects completed Discord linking in the settings pane while the setup code is active, so users do not need a manual refresh after running /hydra link.
• Supports the documented /hydra tail lines option in the centralized Discord command path.
• Adds a guarded npm run discord:sync:centralized helper for syncing the deployed official slash commands.
• Adds the D1 migration for link-code storage and documents the guarded Cloudflare deployment steps with explicit Wrangler config usage and desktop release ordering.
• Tightens auth Worker typing around request metadata and error handling while preserving runtime behavior.

Validation

• npm exec --prefix auth-server -- tsc -p auth-server/tsconfig.json --noEmit
• npm run build
• git diff --check
• npm --prefix auth-server run d1:migrate:local
• node scripts/sync-discord-commands.mjs --help
• node scripts/sync-discord-commands.mjs (guard refusal)
• npm --prefix auth-server run --silent d1:migrate:remote (guard refusal)
• npm --prefix auth-server run --silent deploy (guard refusal)
• npm exec --prefix auth-server -- wrangler deploy --dry-run --config auth-server/wrangler.toml (validated Worker config and bindings; Wrangler log-file warning is sandbox-only)
• GitHub Actions CI success on head d5264d9c7a75e41086f2dcd664b4e62ee3e3a5a9
• GitHub Actions CodeQL success on head d5264d9c7a75e41086f2dcd664b4e62ee3e3a5a9