feat: add signed Discord command foundation and daily check-ins

src/discord/README.md

@@ -0,0 +1,21 @@
+# Discord interface
+
+Signed HTTP interactions enter `/api/discord/interactions`. The raw request body
+is verified with the application's Ed25519 public key and a five-minute timestamp
+window. `DISCORD_PUBLIC_KEY` enables the endpoint; `DISCORD_CLIENT_ID` identifies
+the application. Commands are global with contexts `[0, 1]` (server and bot DM).
+
+`HabitService` remains the shared domain implementation. Verified Discord user IDs
+resolve the same account as website OAuth; new accounts start in UTC. Server
+responses are ephemeral. Buttons/forms carry opaque persisted owner-bound state,
+expire after 15 minutes, and mutation controls are consumed after successful use.
+Interaction IDs retain replay receipts for 24 hours. Neither table stores tokens.
+
+`daily.ts` implements the initial `/today` workflow. `types.ts`, `ui.ts`, and
+`state.ts` provide the shared feature building blocks. Feature tasks extend command
+registration and route dispatch while keeping their behavior in separate modules.
+
+Tests use real Ed25519 signatures and disposable migrated SQLite databases. The
+foundation tests cover server/DM privacy, replay after restart, stale progress,
+cross-account controls, and matching website state. Command registration and live
+Discord validation will be completed during integration.