Admin commands: /admin member set and /admin whois #26

Context

Today, making someone a member or friend means editing config/members.yaml and restarting. Admins should be able to do it from Discord. This changes Pixel's own data only. Mirroring to Discord roles is a separate step (#27).

Depends on #24 (subcommands and the user picker) and #25 (the writable store).

Goal

Admins can add, upgrade, downgrade and remove members and friends, and look people up, from /admin.

Scope

• /admin member set user: level:member|friend|none: one command covers assigning, upgrading, downgrading and removing. The reply is private and shows before and after. Setting the level someone already has says so and changes nothing. An optional reason is logged.
• /admin whois user: shows the person's Pixel tier and where it comes from (admin file or members file), their capabilities, and (once Mirror tiers to Discord roles (Pixel to Discord only) #27 exists) their Discord roles and any mismatch with their Pixel tier.
• Guard rails:
  • admins can't be changed (admin only comes from config/admins.yaml)
  • bots are refused
  • setting someone to none removes their entry and their capabilities
• Every change is audited through the store (Writable access store: members, friends and capabilities managed by admin commands #25).

Acceptance criteria

• Only admins can run these commands (tested through the dispatcher)
• Each of assign, upgrade, downgrade and remove works, persists across a restart, and is logged with actor, target, before and after
• An admin can't be changed, and a bot is refused, each with a clear private message
• A no-op says so and writes nothing
• Removing someone's tier also removes their capabilities
• A failed write is reported clearly and changes nothing
• /admin whois shows tier, source and capabilities
• Docs and the runbook (Operations runbook #13) are updated: adding and removing members is now an admin command

Considerations

• A confirmation step for removals could come later (an ephemeral confirm button)
• Notifying the affected person (a DM) is possible later
• Only Discord people can be targeted for now. Other platforms come with account linking (Secure cross-platform account linking #16)

Decisions made

• The commands are /admin set-level and /admin whois (one level of subcommand). none became guest: demotion keeps the entry and its capabilities, which are inactive while the person is a guest. Removing someone completely is a hand edit plus /admin reload.
• The reason is logged only (200 characters at most).
• whois shows the note as a code span so it cannot render as formatting, links or mentions, and logs each lookup.
• Still to do from this issue: show Discord roles and mismatches in whois once Mirror tiers to Discord roles (Pixel to Discord only) #27 exists, and the runbook (Operations runbook #13).

Implemented in #33.