Open registration to guild members (#27) (#36)

Closes #27.

Guild membership is now the whole gate. `discordCallback` checks membership
(and `DISCORD_REQUIRED_ROLE` when set), then `Store.EnsureReader` creates the
Reader on first sight and returns the same row on every later login. The
refusal returns before `EnsureReader`, so a turned-away sign-in leaves no row
behind. `OWNER_DISCORD_ID` still seeds the owner, but only as the
administrator — it no longer gates login.

The cutover grace path goes with it: `API_TOKEN`, `API_TOKEN_GRACE_UNTIL` and
the legacy branch in `httpmw.ResolveReader` are deleted, so a credential
authenticates exactly one Reader or nothing. `userscript.Handler` drops its
re-derivation too — the resolved path segment is already the credential.

New surfaces: an empty library offers both install links (behind the
tab-specific empty states, so "No favourites yet" still wins), and the owner
alone gets a Readers panel with `POST /readers/{id}/revoke`. The owner's own
row is not revocable — 404, not a self-logout.

Isolation is asserted from both directions for read, modify and delete, and
the shared-series invariant is pinned: two Readers on one series produce one
series row, two independent progresses, one poll per due cycle, and one
Reader's delete leaves the other's bookmark and the poll intact.

Verified: `go test ./...` green; live smoke against a throwaway Postgres —
empty-library state in both colour branches, roster rendering, a real revoke
through the panel (target 401s next request, owner untouched), owner
self-revoke refused 404, per-Reader `/u/<cred>` and bearer auth both 200 with
404 for an unknown credential.

Reviewed-on: #36
Co-authored-by: Sulthan Zaki <sultankiki05@gmail.com>
Co-committed-by: Sulthan Zaki <sultankiki05@gmail.com>

backend/api_test.go

@@ -17,8 +17,6 @@ import (
 	"bookmarkmanager/backend/internal/token"
 )
 
-const testToken = "s3cret-token"
-
 // testTokenKey derives every test Reader's credential; it must match the key
 // newTestStoreURL seeds the owner with, or derived credentials authenticate
 // nothing.
@@ -30,9 +28,7 @@ const testDiscordID = "test-owner"
 
 func testConfig() Config {
 	return Config{
-		Token:          testToken,
 		TokenKey:       testTokenKey,
-		GraceUntil:     time.Now().Add(24 * time.Hour),
 		AllowedOrigins: []string{"https://asuracomic.net", "https://demonicscans.org"},
 		Port:           "8080",
 	}
@@ -72,8 +68,10 @@ func newTestStoreURL(t *testing.T) (*store.Store, string) {
 	return s, url
 }
 
+// auth authenticates a request as the owner Reader, whose derived credential
+// is the only thing the API accepts.
 func auth(req *http.Request) *http.Request {
-	req.Header.Set("Authorization", "Bearer "+testToken)
+	req.Header.Set("Authorization", "Bearer "+ownerCredential())
 	return req
 }
 
@@ -134,7 +132,7 @@ func TestAuthRequired(t *testing.T) {
 	}{
 		{"no header", ""},
 		{"bad token", "Bearer wrong"},
-		{"not bearer", "Basic " + testToken},
+		{"not bearer", "Basic " + ownerCredential()},
 		{"empty bearer", "Bearer "},
 	}
 	for _, tc := range cases {
@@ -604,7 +602,7 @@ func TestPutDoesNotClobberLatestCheckedAt(t *testing.T) {
 		"series_url":"https://asurascans.com/comics/x",
 		"last_chapter":"Chapter 5","last_chapter_num":5}`
 	req := httptest.NewRequest(http.MethodPut, "/bookmarks/asura:x", strings.NewReader(body))
-	req.Header.Set("Authorization", "Bearer "+testToken)
+	req.Header.Set("Authorization", "Bearer "+ownerCredential())
 	req.Header.Set("Content-Type", "application/json")
 	rec := httptest.NewRecorder()
 	srv.ServeHTTP(rec, req)