Add Discord bot (moderation, filters, scheduling, roles, invites, site integration)

Standalone bot/ service (its own package.json/Dockerfile) managed entirely
through a new admin-only Discord Bot panel — token stored encrypted in the
DB and pushed to the bot process in-memory, never an env var. Built in
phases, each independently verified against a live Discord guild:

- Bot skeleton: gateway connection, internal shared-secret API, self-heals
  on its own restart by pulling config from the site
- Moderation core: /ban /kick /mute /warn /warnings + mod-log channel
- Word/invite/spam filtering with leetspeak-resistant normalization and a
  staff role/channel allowlist
- Scheduled messages: recurring (cron) and one-off channel posts
- Role assignment: button role menus, auto-role on join, temp roles,
  bulk role ops
- Auto-rotating primary invite with an audit log
- Site integration: news-publish -> Discord announce webhook, manual
  /announce, read-only /wiki search

Also fixes a pre-existing bug in both DB pools (server + bot): the mariadb
driver defaulted to timezone 'local', silently mis-serializing bound Date
params by the host's local offset instead of the DB's UTC session.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

server/src/router/v1/internal/internal.controller.js

@@ -0,0 +1,19 @@
+const botConfig = require('../../../model/botConfig/botConfig.model')
+const log = require('../../../utils/logger')('internal')
+
+// GET /internal/bot-config — called by the bot process on its own boot so a
+// restart self-reconnects without any admin-panel interaction. Returns the
+// DECRYPTED token — this route must never be reachable outside the private
+// compose network (see requireInternalKey + deployment notes).
+async function getBotConfig(req, res) {
+  try {
+    const config = await botConfig.getWithToken()
+    if (!config) return res.json({ enabled: false, token: null, guildId: null })
+    return res.json({ enabled: config.enabled, token: config.token, guildId: config.guildId })
+  } catch (err) {
+    log.error('internal.getBotConfig', err)
+    return res.status(500).json({ message: 'Internal Server Error' })
+  }
+}
+
+module.exports = { getBotConfig }

server/src/router/v1/internal/internal.routes.js

@@ -0,0 +1,18 @@
+const express = require('express')
+
+const requireInternalKey = require('../../../middleware/requireInternalKey')
+const ctrl = require('./internal.controller')
+
+const router = express.Router()
+
+// Shared-secret gated, not session-gated — the caller is the bot process, not
+// a logged-in browser. Mounted before any auth/session middleware in v1.router.
+router.use(requireInternalKey)
+
+router.get(
+  '/bot-config',
+  // #swagger.ignore = true
+  ctrl.getBotConfig,
+)
+
+module.exports = router