feat(discord): binding reload without a restart, and a per-user channel allowlist (#1509)

`reload` validates the binding file and sends SIGHUP to the live owner;
the running connector re-reads it and swaps guildName, channels, users
and limits in place. name, seat, guildId, botUserId, tokenFile, engine
and context are fixed for the life of the process; a change there, an
invalid file or a channel outside the guild refuses the reload and keeps
the old binding. Every attempt is one line in reloads.jsonl. The service
unit maps `systemctl --user reload` to the same signal.

A user entry may carry `channels`, an allowlist of listed channel ids;
absent means every listed channel. Outside the list the message is
dropped as channel-not-for-user; threads count as their parent.

Suite 41/41, 101 node tests. QUEUE rows 19 and 20 opened.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

scripts/discord.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# `scripts/discord.sh check|run|stop|unlock <binding>`: the Discord connector for
+# `scripts/discord.sh check|run|stop|unlock|recover|reload <binding>`: the Discord connector for
 # one seat on one server. See packages/discord/README.md. The binding lives
 # at <dataRoot>/discord/<binding>.json (0600, never committed); the token
 # stays in the seat's private secrets directory and is read at runtime only.