Console login: Discord OAuth with identify only; /console command

Discord is the only identity system.

- [ ] OAuth authorization-code flow with **`identify` scope only**. Never request `guilds`.
- [ ] Roles are read with the **bot token** (guild member endpoint), not the user's token; organiser/admin gating comes from a role id in `settings`.
- [ ] Discord access tokens last ~7 days with **rotating** refresh tokens — store the current pair per user, replace on every refresh, and treat a refresh failure as logged-out.
- [ ] Session cookie: `HttpOnly`, `Secure`, `SameSite=Lax`, same origin as the API; state parameter on the authorize redirect.
- [ ] `/console` command: answers ephemerally with a short-lived login link that lands the user straight in the console.
- [ ] PKCE is unnecessary for a confidential client and whether Discord's token endpoint accepts it is undocumented — don't rely on it.

No files or tests are named. Start by mapping the Discord bot command handler, OAuth/API entry points, settings, and session storage in the Cloudflare Workers project, then verify Discord's authorization, member, and token-refresh behavior. Done means every checklist item works, including role gating, rotating refresh tokens, secure sessions, and the ephemeral /console login link.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.