Open registration to guild members (#27) (#36)

Closes #27.

Guild membership is now the whole gate. `discordCallback` checks membership
(and `DISCORD_REQUIRED_ROLE` when set), then `Store.EnsureReader` creates the
Reader on first sight and returns the same row on every later login. The
refusal returns before `EnsureReader`, so a turned-away sign-in leaves no row
behind. `OWNER_DISCORD_ID` still seeds the owner, but only as the
administrator — it no longer gates login.

The cutover grace path goes with it: `API_TOKEN`, `API_TOKEN_GRACE_UNTIL` and
the legacy branch in `httpmw.ResolveReader` are deleted, so a credential
authenticates exactly one Reader or nothing. `userscript.Handler` drops its
re-derivation too — the resolved path segment is already the credential.

New surfaces: an empty library offers both install links (behind the
tab-specific empty states, so "No favourites yet" still wins), and the owner
alone gets a Readers panel with `POST /readers/{id}/revoke`. The owner's own
row is not revocable — 404, not a self-logout.

Isolation is asserted from both directions for read, modify and delete, and
the shared-series invariant is pinned: two Readers on one series produce one
series row, two independent progresses, one poll per due cycle, and one
Reader's delete leaves the other's bookmark and the poll intact.

Verified: `go test ./...` green; live smoke against a throwaway Postgres —
empty-library state in both colour branches, roster rendering, a real revoke
through the panel (target 401s next request, owner untouched), owner
self-revoke refused 404, per-Reader `/u/<cred>` and bearer auth both 200 with
404 for an unknown credential.

Reviewed-on: #36
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

DEPLOY.md

@@ -36,8 +36,9 @@ Edit `.env`:
 # Only SHA-256 hashes of credentials are stored.
 TOKEN_KEY=<paste output of: openssl rand -hex 32>
 
-# Required — the owner's Discord user ID. Seeds the one Reader every bookmark
-# belongs to; the value is the snowflake in your Discord profile (Settings →
+# Required — the owner's Discord user ID. Seeds the first Reader: the
+# administrator, and the owner of every bookmark that predates registration.
+# The value is the snowflake in your Discord profile (Settings →
 # Advanced → Developer Mode → right-click your name → Copy User ID).
 OWNER_DISCORD_ID=<discord user id>
 
@@ -74,10 +75,8 @@ grep -E '^TOKEN_KEY=' .env
 
 `TOKEN_KEY` derives every Reader's userscript credential (issue #24); only
 SHA-256 hashes of the credentials are stored, so this secret is what a
-database leak alone cannot recover. If you are upgrading across the cutover,
-also set `API_TOKEN` (the retired global credential) and
-`API_TOKEN_GRACE_UNTIL` in `.env` so already-installed scripts keep working
-for the window — see §6.
+database leak alone cannot recover. Changing it invalidates every installed
+script at once.
 
 `POSTGRES_PASSWORD` is read **only while the `postgres-data` volume is empty**,
 which in practice means at first boot. Changing it afterwards changes the URL
@@ -124,8 +123,10 @@ gated by membership in one configured guild.
 
    The guild id is in Discord's client with Developer Mode on: right-click the
    server name → Copy Server ID. The four uncommented variables are required —
-   the backend refuses to start without them. `OWNER_DISCORD_ID` from §1 is the
-   only Discord identity allowed to sign in while registration is closed.
+   the backend refuses to start without them. Guild membership *is*
+   registration: any member of `DISCORD_GUILD_ID` becomes a Reader with their
+   own library on their first sign-in. `OWNER_DISCORD_ID` from §1 is only the
+   administrator — the Reader who can revoke another Reader's sessions.
 
 4. Redeploy and check:
 
@@ -188,9 +189,10 @@ curl -s https://bookmark-api.violetcrown.my.id/healthz          # -> ok
 curl -s -o /dev/null -w '%{http_code}\n' \
   https://bookmark-api.violetcrown.my.id/bookmarks              # -> 401
 
-# During the grace window the retired global credential still resolves to the
-# owner; afterwards it is 401 like any other wrong credential.
-TOKEN=$(grep -E '^API_TOKEN=' .env | cut -d= -f2)
+# A Reader's own credential. It is derived, never stored in .env — take it from
+# the Userscripts panel's install link after signing in, or from an installed
+# script's API_TOKEN constant.
+TOKEN=<your Reader credential>
 curl -s -H "Authorization: Bearer $TOKEN" \
   https://bookmark-api.violetcrown.my.id/bookmarks              # -> []