[task] Store channel-to-team access settings #238

What

Add authenticated directory endpoints to read, replace, and clear the teams
associated with a Discord channel.

Why

The helper bot needs a durable channel scope that survives restarts and can be
resolved consistently by document retrieval.

Area

service

Done looks like

• A guild/channel pair can be associated with multiple valid teams.
• The configuration survives restart and can be read, replaced, or cleared.
• An absent or empty configuration grants no document access.
• Retired teams no longer contribute access; changes can invalidate cached scope.
• Writes require the appropriate scope and record the authenticated actor.
• Both storage adapters, migration checks, and API tests cover the behavior.

Design notes

Part of #77.

Owned by team-tracking, alongside the teams being referenced. Consumers use its
HTTP API. This stores the selected teams; #76 supplies their document grants
and #176 applies the union during retrieval.

Out of scope

Discord configuration commands (#239), Google Group provisioning (#237), and document retrieval
(#176).