Capture member/filter/spam events for the dashboard (Phase 6b)

Light up the moderation dashboard's previously-empty widgets by persisting the
event streams the bot only reacted to in-memory before.

Schema (bot-owned)
- member_events: join/leave, with invite_code/inviter_* for best-effort invite
  attribution on joins
- filter_hits: word / foreign-invite filter deletions (matched + action_taken)
- spam_hits: rate_limit / mass_mention / mass_emoji detections

Bot
- new models memberEvents/filterHits/spamHits
- guildMemberAdd records the join with invite attribution; new inviteTracker.js
  keeps an invite-use cache (GuildInvites intent + inviteCreate/inviteDelete) and
  diffs it on join to find which invite was used — best-effort, never blocks
  auto-role
- new guildMemberRemove records leaves
- messageFilter records filter/spam hits alongside the existing warn/mute;
  inviteFilter now returns the offending code; detectSpam identifies which spam
  rule tripped (preserving the rate-limit-first side-effect order)
- mod_actions still logs the resulting warn/mute — the new tables are additive

Server
- summary extended with joins/leaves/invite_joins/filter_hits/spam_hits per window
- new feeds: /api/v1/admin/moderation/{members,filter-hits,spam-hits}

Client
- overview now shows 8 tiles (mod actions + joins/leaves/filter/spam, joins tile
  notes "N via invite") plus an Events panel with Members/Filter/Spam tabs;
  removed the coming-soon note

Verified: 119 server unit tests, client build, 14-check DB-backed smoke, and a
browser click-through of every tile and events tab (incl. invite attribution).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019rao86n5cXpwAyjdBFEshV

server/test/moderation.test.js

@@ -71,3 +71,19 @@ test('annotate: no linked identity yields null linked_account', () => {
   const [row] = moderation.annotate([{ staff_user_id: '1', target_site_user_id: null }], null)
   assert.equal(row.linked_account, null)
 })
+
+test('windowValue: picks the right column per window key and coerces to number', () => {
+  const row = { d1: '2', d7: 5, d30: '11' }
+  assert.strictEqual(moderation.windowValue(row, '24h'), 2)
+  assert.strictEqual(moderation.windowValue(row, '7d'), 5)
+  assert.strictEqual(moderation.windowValue(row, '30d'), 11)
+})
+
+test('windowValue: null row (no rows in window) yields 0', () => {
+  assert.strictEqual(moderation.windowValue(null, '24h'), 0)
+  assert.strictEqual(moderation.windowValue(undefined, '30d'), 0)
+})
+
+test('windowValue: null sum column yields 0', () => {
+  assert.strictEqual(moderation.windowValue({ d1: null, d7: null, d30: null }, '7d'), 0)
+})