Gate the Discord /assign command on the invoker, not just the ticket id #275

/assign in the Discord bot resolves a ticket from the display id the invoker types and reassigns it, without checking who is asking or whether the ticket belongs to the channel it was invoked from.

apps/discord-bot/src/commands/assign.ts:11-15 does a findUnique on displayId and proceeds. There is no role check, no participant check, and no scoping to the invoking guild or channel.

Display ids are public by design — they are pasted into community threads, and the repo documents in several places that naming a ticket is not evidence of belonging to it. The web routes and the email reply path both act on that: each checks the session or the sender before touching a ticket. This command does not.

Worth deciding two things together: which Discord roles may reassign at all, and whether a ticket from one source should be reachable from a command invoked somewhere unrelated. The other call sites already have the shape to copy.

Found while reviewing #270, which changed how display ids are generated. It is unrelated to that change and predates it.