feat: middleware guards — permission-based handler access control

[jordanpartridge]

Summary

Adds permission-based middleware guards under src/Bot/Middleware/Guards/:

• Guard interface — contract with authorize(userId, channelId): bool for custom guards
• RequiresRole — short-circuits if user lacks a specific Mattermost role (e.g. system_admin)
• RequiresPermission — maps permission names to roles (e.g. manage_team → team_admin|system_admin)
• ChannelMember — verifies user is a member of the post's channel via GET /channels/{id}/members/{userId}

All guards follow the existing cache-backed pattern from AdminOnly with configurable TTL via mattermost.bot.guard_cache_ttl (default 300s).

Closes #13

Test plan

• RequiresRole — 7 tests: allows/blocks by role, caches lookups, handles API failures, passes non-PostCreated events, drops empty userId, implements Guard interface
• RequiresPermission — 8 tests: allows/blocks by permission→role mapping, denies unknown permissions, caches, handles API failures, passes non-PostCreated, implements Guard
• ChannelMember — 9 tests: allows members, blocks non-members, caches per user+channel, checks different channels separately, handles API failures, passes non-PostCreated, drops empty userId/channelId, implements Guard
• pint --test — passed
• pest — 292 passed, 0 failed
• phpstan analyse (level 8) — 0 errors
• rector --dry-run — no changes

Demo: pending — orchestrator will post

[lexi-chief-of-staff]

Ship it.

• Clean abstraction on top of AdminOnly caching/API pattern.
• Tests cover allows/blocks/caches/failures/empty IDs/non-posts systematically.
• PERMISSION_ROLE_MAP reasonable starting set; easy to extend.
• Keys TTL-checked and min 1s — avoids perf footguns.