feat(auth): unified team lead authorization for roles and individual members

[espdesign]

Summary of Changes

Follows up on PR #43 and closes #44 by expanding the Team Lead authorization model so Server Managers can authorize both Discord roles and individual Discord members to create and manage projects and squads using unified commands and UI.

1. Database Schema & Migrations

• Added GuildLeadUserTable (guild_lead_users with composite primary key (guild_id, user_discord_id) and indexed foreign-key lookups) in src/adapters/db/tables.py.
• Added sequential Alembic migration 0003_add_guild_lead_users.py.
• Implemented IGuildLeadUserRepository port and PostgresGuildLeadUserRepository adapter in src/adapters/db/postgres_repo.py.
• Wired guild_lead_users into IUnitOfWork and SqlAlchemyUnitOfWork.

2. Domain & Authorization Services

• Updated AuthService.can_manage_projects(user, guild_id, guild) and require_project_management to authorize:
  1. Discord Server Managers (manage_guild / administrator).
  2. Authorized Individual Team Lead members (guild_lead_users).
  3. Configured Team Lead roles (guild_lead_roles).
  4. Active Squad Leads in the guild.
• Added methods add_guild_lead_user, remove_guild_lead_user, and list_guild_lead_users to AuthService.
• Auto-wired guild_lead_user_repo in PmHubView, forum_helpers, and main.py.

3. Slash Commands (/pm admin lead)

• Added unified command /pm admin lead action:<add|remove|list> role:<@Role> user:<@Member> in PmCog.
  • Supports adding or removing roles, individual members, or listing both.
  • Automatically validates that bots cannot be designated as individual team leads.
• Maintained /pm admin lead-role as a backwards-compatible alias.

4. Interactive Discord UI (TeamLeadsAdminView)

• Replaced the /pm menu button label with Team Leads.
• Implemented TeamLeadsAdminView with native Discord RoleSelect and UserSelect pickers and 1-click Assign/Remove actions for both roles and members.
• Maintained LeadRolesAdminView = TeamLeadsAdminView alias for backwards compatibility.

5. Self-Healing on Server Departure

• Updated DggPmBot.on_member_remove to automatically prune individual lead user entries from guild_lead_users when a member leaves the server.

6. Documentation

• Updated docs/wiki/Teams-and-Authorization.md with updated hierarchy diagrams, mutation authorization matrix, and departure lifecycle details.
• Updated docs/wiki/Slash-Commands-Reference.md detailing /pm admin lead and updated permission scopes.

---

Testing & Verification

• Full Test Suite: 393/393 passing (direnv exec . uv run pytest).
• Linter & Formatting: ruff check . (0 errors) and ruff format --check . (clean).
• Alembic Migrations: tests/test_migrations.py all passing.
• Docker: Container built and restarted via docker compose up -d --build app.

Closes #44