feat: Community Patreon campaign association

Context

Community owners need to designate which Patreon campaign their community corresponds to. This is separate from a user linking their own Patreon account — here the community owner authenticates as the creator so the platform can access the campaign's patron list on their behalf.

Acceptance Criteria

• Community Settings page has a "Patreon Integration" section
• Community owner clicks "Connect Patreon Campaign" → Patreon OAuth flow (as creator, campaigns + campaigns.members scopes)
• On success, store campaign_id, creator access_token / refresh_token (encrypted) against the community
• Community settings display linked campaign name, URL, and patron count
• Community owner can disconnect the campaign (tokens deleted, patron sync disabled)
• Disconnecting clears sponsor status for all members (or schedules a grace-period sweep — team decision)
• Optionally: surface a "Supported on Patreon" link/badge on the community public page

Technical Notes

• Patreon OAuth scopes needed: campaigns (read campaign metadata), campaigns.members (read patron list with emails)
• DB migration: add patreon_campaign_id, patreon_creator_access_token (encrypted), patreon_creator_refresh_token (encrypted), patreon_token_expires_at to communities table (or new community_patreon_campaigns table if a community could have multiple)
• Reuse PATREON_CLIENT_ID / PATREON_CLIENT_SECRET from the user-linking issue, but this OAuth flow is performed as the creator role

Dependencies

• Shares Patreon OAuth infrastructure with user account linking issue (implement together or after)

Future Scope

Patreon tier metadata (tier names, amounts) should be synced here in a future pass to enable tier-gated features.

Start by locating the community settings page, the communities schema, and the existing user Patreon OAuth infrastructure referenced in the issue. Map the creator OAuth flow, encrypted token storage, campaign and patron display, and disconnect behavior. Done means the acceptance criteria are implemented, with the grace-period decision resolved and the dependency available.