Add Discord role and ban lookup to commanderbot-py

[vdvman1]

Question

Manual work, not a decision — but the auth and moderation design cannot be validated until the site can actually read Discord roles and bans.

Not a new bot. MinecraftCommands already maintains one: https://github.com/MinecraftCommands/commanderbot-py. This is a PR to it plus whatever guild-side configuration it needs, not a fresh application added to the server.

The requirements come out of the auth stack decision. Broadly:

• A way for mcc-tools to ask whether a Discord user is a member of the MCC guild, which roles they hold, and whether they are banned.
• Whichever direction that decision chose — bot pushes changes to Convex on member/ban events, or the site pulls on demand — plus the credential to authenticate the channel between them.

Do:

• Open a PR against commanderbot-py implementing it.
• Sort out guild-side permissions. The map's driver is a moderator on the MCC Discord, not necessarily an admin — flag early if a server admin has to grant something, so it is not discovered at the end.
• Get credentials into Vercel and Convex environments, and document them in .env.example and src/env.js. Note that DISCORD_CLIENT_ID and DISCORD_CLIENT_SECRET are already in .env.example but currently unused — auth code was removed in 1d3a870.

Record in the resolution: the PR link, where credentials live, the exact shape of the interface exposed, and any guild-side step still outstanding. Later tickets depend on those facts.

Blocked on the auth stack decision.

[vdvman1]

This ticket is now load-bearing, per #34. Full write-up: docs/research/better-auth-convex.md

The research found there is no way for Convex to receive Discord role or ban changes on its own. Discord Webhook Events don't cover member/role/ban events, and every other mechanism needs a persistent Gateway connection — which Convex cannot host. OAuth gives only a snapshot of role IDs at sign-in, and ban checks need a bot token with BAN_MEMBERS, which the OAuth flow cannot provide.

commanderbot-py already holds a persistent Gateway connection, so it is the only component in the system that can see these events as they happen. That makes this a push from the bot into Convex, not a pull from the site — the pull option the ticket originally left open is not actually available.

Scope implied:

• Listen for member join/leave, role update, and ban/unban events on the MCC guild.
• Push them to a Convex endpoint, authenticated with a shared secret.
• The bot token needs BAN_MEMBERS for ban lookups.

Still blocked on #42, which decides the exact interface shape — but the direction of the integration is now settled.