feat(bot): Accept/Reject buttons + role grant on accept

[Musiker15]

Phase 1 finish — Task 3/5: Discord review actions + role grant

Completes the Discord review loop (concept §5.1 step 8 / §11). The new-submission embed now carries Accept / Reject buttons; staff act without leaving Discord, and acceptance grants the configured role.

Changes

• review embed gains Accept/Reject buttons (customId: sub:<action>:<submissionId>) next to the dashboard link.
• review-actions.ts handles the button: Manage Server permission check, then mirrors the web events route — sets status (accepted/rejected), writes a public status_change event, and queues a status_change DM to the applicant via the outbox (reusing 6b).
• on accept, grants the guild's configured acceptedRole to the applicant (members.fetch by Discord id → roles.add); best-effort — logs and continues on missing-permission / role-hierarchy errors, the status change still stands.
• the review message is edited to show the decision and disable the buttons.

Notes

• No new gateway intent (single-member fetch is REST). The bot needs Manage Roles + its role above the target role for the grant to succeed.
• Idempotent: clicking again when already in that status just refreshes the message.

Verification

• pnpm typecheck (web+bot) ✅ · pnpm lint ✅ · pnpm test ✅ · bot loads under tsx ✅