feat: register any guild member as a Reader (#27)

Guild membership is now the whole gate: discordCallback checks membership
(and DISCORD_REQUIRED_ROLE when set), then Store.EnsureReader creates the
Reader on first sight and returns the same row on every later login. The
refusal returns before EnsureReader, so nothing is created as a side
effect of being turned away. OWNER_DISCORD_ID keeps seeding the owner, but
only as the administrator — it no longer gates sign-in.

The cutover grace path is gone with it: API_TOKEN, API_TOKEN_GRACE_UNTIL
and the legacy branch in httpmw.ResolveReader are deleted, so a credential
authenticates exactly one Reader or nothing. That also lets
userscript.Handler drop the re-derivation — the resolved path segment is
already the credential to substitute.

New surfaces: an empty library offers both install links instead of
describing a filter (listView.Fresh, which also hides the action key it has
nothing to name), and the owner alone gets a Readers panel with
POST /readers/{id}/revoke (404 for anyone else) to sign a Reader out
everywhere.

Isolation is asserted from both directions rather than by counting one
Reader's rows, and the shared-series invariant is pinned: two Readers on
one series produce one series row, two independent progresses, one poll
per due cycle, and one Reader's delete leaves the other's bookmark and the
poll intact.

DEPLOY.md

@@ -36,8 +36,9 @@ Edit `.env`:
 # Only SHA-256 hashes of credentials are stored.
 TOKEN_KEY=<paste output of: openssl rand -hex 32>
 
-# Required — the owner's Discord user ID. Seeds the one Reader every bookmark
-# belongs to; the value is the snowflake in your Discord profile (Settings →
+# Required — the owner's Discord user ID. Seeds the first Reader: the
+# administrator, and the owner of every bookmark that predates registration.
+# The value is the snowflake in your Discord profile (Settings →
 # Advanced → Developer Mode → right-click your name → Copy User ID).
 OWNER_DISCORD_ID=<discord user id>
 
@@ -74,10 +75,8 @@ grep -E '^TOKEN_KEY=' .env
 
 `TOKEN_KEY` derives every Reader's userscript credential (issue #24); only
 SHA-256 hashes of the credentials are stored, so this secret is what a
-database leak alone cannot recover. If you are upgrading across the cutover,
-also set `API_TOKEN` (the retired global credential) and
-`API_TOKEN_GRACE_UNTIL` in `.env` so already-installed scripts keep working
-for the window — see §6.
+database leak alone cannot recover. Changing it invalidates every installed
+script at once.
 
 `POSTGRES_PASSWORD` is read **only while the `postgres-data` volume is empty**,
 which in practice means at first boot. Changing it afterwards changes the URL
@@ -124,8 +123,10 @@ gated by membership in one configured guild.
 
    The guild id is in Discord's client with Developer Mode on: right-click the
    server name → Copy Server ID. The four uncommented variables are required —
-   the backend refuses to start without them. `OWNER_DISCORD_ID` from §1 is the
-   only Discord identity allowed to sign in while registration is closed.
+   the backend refuses to start without them. Guild membership *is*
+   registration: any member of `DISCORD_GUILD_ID` becomes a Reader with their
+   own library on their first sign-in. `OWNER_DISCORD_ID` from §1 is only the
+   administrator — the Reader who can revoke another Reader's sessions.
 
 4. Redeploy and check:
 
@@ -188,9 +189,10 @@ curl -s https://bookmark-api.violetcrown.my.id/healthz          # -> ok
 curl -s -o /dev/null -w '%{http_code}\n' \
   https://bookmark-api.violetcrown.my.id/bookmarks              # -> 401
 
-# During the grace window the retired global credential still resolves to the
-# owner; afterwards it is 401 like any other wrong credential.
-TOKEN=$(grep -E '^API_TOKEN=' .env | cut -d= -f2)
+# A Reader's own credential. It is derived, never stored in .env — take it from
+# the Userscripts panel's install link after signing in, or from an installed
+# script's API_TOKEN constant.
+TOKEN=<your Reader credential>
 curl -s -H "Authorization: Bearer $TOKEN" \
   https://bookmark-api.violetcrown.my.id/bookmarks              # -> []