Gate the Discord /assign command on the invoker, not just the ticket id

/assign in the Discord bot resolves a ticket from the display id the invoker types and reassigns it, without checking who is asking or whether the ticket belongs to the channel it was invoked from.

apps/discord-bot/src/commands/assign.ts:11-15 does a findUnique on displayId and proceeds. There is no role check, no participant check, and no scoping to the invoking guild or channel.

Display ids are public by design — they are pasted into community threads, and the repo documents in several places that naming a ticket is not evidence of belonging to it. The web routes and the email reply path both act on that: each checks the session or the sender before touching a ticket. This command does not.

Worth deciding two things together: which Discord roles may reassign at all, and whether a ticket from one source should be reachable from a command invoked somewhere unrelated. The other call sites already have the shape to copy.

Found while reviewing #270, which changed how display ids are generated. It is unrelated to that change and predates it.

Start with apps/discord-bot/src/commands/assign.ts:11-15 and trace the web routes and email reply path that already check the actor before changing a ticket. Determine the allowed Discord roles and whether source or channel scoping is required. Done means /assign applies those checks before reassignment, with coverage for unauthorized and unrelated-ticket requests.