Add Discord role sync with role-centric architecture (#22)

* Add Discord role sync with role-centric architecture

This refactors the access management to use a role-centric model where
each role explicitly defines which platforms it exists on (GitHub,
Discord, Google).

Key changes:
- Add Discord role sync via Pulumi Dynamic Provider
- Replace groups.ts with roleIds.ts + roles.ts for type-safe role definitions
- Use ROLE_IDS constants to prevent typos in memberOf references
- Each role has platform-specific config (github/discord/google keys)
- Discord-only roles (e.g., administrators) and GitHub-only roles
  (e.g., typescript-sdk-auth) are now explicitly modeled
- Add PR preview workflow to show Pulumi changes before merge
- Add test-config.ts for config structure validation
- Fix typo: docs-maintaners -> docs-maintainers

Discord roles will match existing server roles:
- administrators, lead maintainers, core maintainers
- sdk maintainers, working groups, interest groups
- etc.

Requires new GitHub secrets:
- DISCORD_BOT_TOKEN
- DISCORD_GUILD_ID

* Fix GitHub team ordering and make Discord integration optional

- Add topological sort for GitHub teams to ensure parent teams are
  created before child teams, fixing the registry-wg parentTeamId issue
- Make Discord integration optional by using config.get() instead of
  config.require(), allowing CI preview to succeed without Discord secrets
- Add sortRolesByGitHubDependency() utility function in config/utils.ts

Claude-Generated-By: Claude Code (cli/claude-opus-4-5=20%)
Claude-Steers: 2
Claude-Permission-Prompts: 1
Claude-Escapes: 0

* Reconcile Discord roles for listed users

Replace per-role-membership approach with per-user role sync that:
- Adds missing roles users should have
- Removes managed roles users shouldn't have
- Only touches roles defined in config (won't affect admin roles, etc.)

Users not in config remain untouched.

Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 4
Claude-Permission-Prompts: 1
Claude-Escapes: 0

* Fix descriptions to match existing resources

* Cache Pulumi plugins and fix GITHUB_TOKEN for pulumi install

* Remove accidentally committed state backup

* Use github.token for pulumi install

* Fix formatting

Fix deploy: add pulumi login before config set

Fix deploy: set PULUMI_CONFIG_PASSPHRASE_FILE for config commands

Import existing docs-maintainers team (remove after deploy)

Remove docs-maintainers import workaround

Add docs-maintainers cleanup to state cleanup

Add pulumi refresh before up to sync state with reality

Rename Discord roles to add (synced) suffix

Cleanup Makefile and add lead-maintainers GitHub team

.github/workflows/deploy.yml

@@ -34,7 +34,17 @@ jobs:
         with:
           pulumi-version: ${{ env.PULUMI_VERSION }}
 
+      - name: Cache Pulumi plugins
+        uses: actions/cache@v4
+        with:
+          path: ~/.pulumi/plugins
+          key: pulumi-plugins-${{ hashFiles('Pulumi.yaml') }}
+          restore-keys: |
+            pulumi-plugins-
+
       - name: Install Pulumi packages
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: pulumi install
 
       - name: Install dependencies
@@ -52,6 +62,12 @@ jobs:
         env:
           PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
           GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }}
+          DISCORD_BOT_TOKEN: ${{ secrets.DISCORD_BOT_TOKEN }}
+          DISCORD_GUILD_ID: ${{ secrets.DISCORD_GUILD_ID }}
         run: |
           echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
+          export PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt
+          pulumi login gs://mcp-access-prod-pulumi-state
+          pulumi config set discord:guildId "$DISCORD_GUILD_ID" --stack prod
+          pulumi config set discord:botToken "$DISCORD_BOT_TOKEN" --secret --stack prod
           make up