[Feature]: Unified Team Lead Authorization (Roles & Individual Members)

[espdesign]

Summary

Following up on PR #43 (feat(auth): configurable team lead roles for project and squad management), expand the delegation model so Server Managers can authorize both Discord roles and individual Discord members to create and manage projects and squads using unified administrative commands and UI.

Background & Context

PR #43 introduced configurable team lead roles (guild_lead_roles table, /pm admin lead-role, and LeadRolesAdminView). This enabled least-privilege delegation without requiring server-wide Manage Server or Administrator permissions.

However, in many Discord servers and agile groups:

1. Managers frequently want to grant project management capabilities to specific trusted individuals, external contractors, or tech leads without the administrative overhead of creating and maintaining a distinct Discord server role.
2. Relying solely on server roles for 1–2 individuals causes "role bloat" on user profiles and in Discord guild role lists.
3. Providing unified commands and UI for both roles and individual members offers a cohesive, first-class administration experience.

Proposed Capabilities

1. Database Schema & Persistence:

   • Add GuildLeadUserTable (guild_lead_users with composite PK (guild_id, user_discord_id) and created_at).
   • Add Alembic migration (0003_add_guild_lead_users.py).
   • Implement IGuildLeadUserRepository port and PostgresGuildLeadUserRepository adapter.
   • Wire repository into SqlAlchemyUnitOfWork.

2. Domain & Authorization Services:

   • Update AuthService.can_manage_projects(user, guild_id, guild):
     1. Discord Server Manager (manage_guild / administrator).
     2. Authorized Individual Team Lead members (guild_lead_users).
     3. Configured Team Lead roles (guild_lead_roles).
     4. Active Squad Leads in the guild.
   • Add methods add_guild_lead_user, remove_guild_lead_user, and list_guild_lead_users.

3. Unified Slash Command (/pm admin lead):

   • Add unified command:
     /pm admin lead action:<add|remove|list> role:<@Role> user:<@Member>
   • Allows authorizing/revoking roles, individual members, or both in a single invocation.
   • Maintain /pm admin lead-role as a backwards-compatible alias.

4. Unified Interactive UI (TeamLeadsAdminView):

   • Update /pm menu button to Team Leads.
   • Embed native Discord RoleSelect and UserSelect dropdowns within a single admin portal.
   • Render both configured roles and configured individual members in the status embed.
   • Auto-wire guild_lead_user_repo in PmHubView and pinned forum control hubs.

5. Self-Healing on Server Departure:

   • Auto-prune guild_lead_users in on_member_remove if an authorized individual leaves the server.

6. Documentation & Wiki:

   • Update docs/wiki/Teams-and-Authorization.md and docs/wiki/Slash-Commands-Reference.md.

Acceptance Criteria

• Alembic migration 0003_add_guild_lead_users.py creates table with composite PK (guild_id, user_discord_id).
• AuthService.can_manage_projects grants authority to designated individual members.
• /pm admin lead action:add|remove|list works cleanly for both roles and users.
• Interactive /pm menu portal supports adding and removing roles and individual users via unified RoleSelect and UserSelect pickers.
• Departure listener cleans up individual lead records when a member leaves the server.
• Comprehensive unit, integration, and cog test coverage added to tests/test_authorization.py, tests/test_cogs.py, and tests/test_menus.py.
• All checks passing (make check).