feat: move dynamic Discord roles from env vars to database

[dimoschi]

Summary

• Moves dynamic Discord roles (ranks, certs, seasons, subscriptions, creators, positions, joinable) from required env vars to a DB-backed DynamicRole table with in-memory cache
• Core roles (moderation, permissions) remain as required env vars since they're used in decorators at import time
• Adds /admin role CRUD commands so bot admins can manage roles at runtime without redeployment
• New academy certs, ranks, etc. require zero code changes, just an /admin role add command

Motivation

PR #177 added ACADEMY_CWPE as a required env var but it was forgotten in production config, crashing the bot on deploy. This makes the bot resilient to missing dynamic roles (graceful degradation) and eliminates the need for code changes when adding new roles.

Key Design Decisions

• Race condition prevention: RoleManager loads synchronously in __main__.py before either the webhook server or Discord bot starts
• Dual-read fallback: Dynamic role fields are Optional[int] = None in the Roles class. RoleManager tries DB first, falls back to env vars if set. Safe to deploy with empty DB table.
• Cert mappings fully in DB: cert_full_name and cert_integer_id columns on academy_cert rows replace the hardcoded AcademyCertificates class and process_certification() mapping
• Autocomplete for /join and /leave: Replaces static choices= with dynamic autocomplete from DB
• Extensible admin structure: /admin group defined in admin.py, subgroups added via admin.create_subgroup()

New Commands

Command	Permission	Description
/admin role add	ALL_ADMINS	Add a new dynamic role
/admin role remove	ALL_ADMINS	Remove a dynamic role
/admin role update	ALL_ADMINS	Update a role's Discord ID
/admin role list	ALL_ADMINS, ALL_MODS	List configured roles
/admin role reload	ALL_ADMINS	Force reload from DB

Deployment Steps

1. Run the Alembic migration to create the dynamic_role table
2. Deploy the new code (env vars still work as fallback)
3. Run ENV_PATH=/path/to/.env python -m scripts.seed_dynamic_roles to populate DB from existing env vars
4. Verify bot works from DB
5. (Follow-up PR) Remove Optional fallback fields and env vars

Test plan

• All 262 tests pass
• Verify bot starts with existing env vars and empty DB table (fallback works)
• Run seed script against staging env
• Test /admin role add, /admin role list, /admin role remove in Discord
• Test /join autocomplete works
• Test /verifycertification with a valid cert
• Test webhook handlers (rank up, cert awarded, subscription change)
• Verify graceful degradation when a role is missing from DB

[codecov]

Codecov Report

❌ Patch coverage is 89.03509% with 25 lines in your changes missing coverage. Please review.
✅ Project coverage is 64.76%. Comparing base (b0eb0e1) to head (a6ceb1f).

Files with missing lines	Patch %	Lines
src/helpers/verification.py	63.15%	14 Missing ⚠️
src/bot.py	16.66%	5 Missing ⚠️
src/cmds/core/admin.py	71.42%	4 Missing ⚠️
src/webhooks/handlers/mp.py	75.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #179      +/-   ##
==========================================
+ Coverage   62.10%   64.76%   +2.66%     
==========================================
  Files          50       53       +3     
  Lines        2953     3057     +104     
==========================================
+ Hits         1834     1980     +146     
+ Misses       1119     1077      -42     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[0xRy4n]

Looks good to me, but I think we are missing the alembic migration for DynamicRole?