v1.3.2

Added

• Sign-in on beta and staging is now restricted to Bug Hunters (instance
  owners bypass it, so they can't lock themselves out of their own
  environment). Rejected cleanly at the OAuth login step
  (checkBugHunterOnly, same pattern as the existing checkBanScope),
  plus a matching global check in api/uapi.go for defense in depth on
  any session issued before this. Reads the same users.bug_hunters
  column SpecRoleSync already keeps in sync with the Bug Hunter Discord
  role no new sync mechanism, no new schema.

• Real account bans: a new BanUser/UnbanUser RPC action (new
  ban_users permission) sets users.banned, distinct from
  AppBanUser/AppUnbanUser's much narrower app_banned flag. Nothing
  previously set the column at all despite api/uapi.go already rejecting
  every authenticated request from a banned user except sessions scoped
  ban_exempt a full account ban was completely unreachable through any
  staff action.

• VoteBanAdd/VoteBanRemove now support Server, Team, and Pack in
  addition to Bot (all four carry an identical vote_banned column).
  ForceRemove now supports Server and Pack in addition to Bot
  the kick/protected-bots behaviour stays bot-only, since neither has a
  "leave the guild" equivalent. This is the reports-can't-act-on-non-bot-
  content gap: reports against a server or pack had no staff action to
  take beyond bots.

• A generic badge system: a staff-managed catalog (badges) plus a
  flexible assignment table (entity_badges), so a new purely-decorative
  badge is a catalog row and an assignment from now on, not a new column,
  backend flag, and frontend branch every time. New AssignBadge/
  UnassignBadge RPC action (new assign_badges permission, works on
  User/Bot/Server/Team) reaches every entity type through the same
  Actions menu as every other staff action, and a new
  GET /{target_type}/{target_id}/badges public route reads them back.
  Deliberately separate from the functional badges already on
  users/bots/servers (premium, certified, developer, bug_hunters the
  last one specifically because it's synced from a Discord role by
  SpecRoleSync, not manually assigned, so it stays exactly as-is)
  new manage_badges permission gates the catalog itself.

• Bots can now document their own commands and post changelog/announcement
  entries, gated by the same edit_bots entity permission (owner or team)
  that already gates editing a bot's settings no new permission needed.
  PUT /bots/{id}/commands replaces the whole command list (same
  full-replace convention as extra_links); POST/DELETE /bots/{id}/changelogs append and remove individual entries (same
  convention as reviews). Both are public to read.

  • A new Health route group, GET /health/* — one endpoint per subsystem
    (database, API, bot/server/pack listings, blog, search, Discord auth,
    tickets, staff panel, plus Infernoplex's and Arcadia's separate Discord
    gateway connections), each returning a bare 200/503 with no body to
    parse. Built for the new external status page (omni-status) to point one
    uptime monitor at each endpoint — mirrors what Omniplex's own
    /about/status page already self-probes client-side, done server-side
    instead so an outside monitor doesn't need API-client internals.

• Servers now go through the same staff review pipeline bots already do:
  PUT /servers previously defaulted straight to type = 'approved', so
  every server went live immediately with zero review, unlike bots
  (type default flipped to pending via exp/serverreview.sql, existing
  rows untouched). Claim/Unclaim/Approve/Deny/Unverify now support
  Server alongside Bot (shares the existing review_bots permission,
  same precedent as VoteBanAdd/ForceRemove already covering multiple
  target types under one permission), and a new ServerQueue panel op
  mirrors BotQueue. No server equivalent of the bot-approval Discord
  role auto-grant exists, so Approve stops at the state transition and
  mod-log post for servers.

• Some Bot Reviews/Users & Votes staff permissions (transfer_bots,
  force_remove_bots, manage_premium, manage_votes, ban_voters)
  reclassified under a new Content Management category — these act on
  listed entities (transferring, deleting, granting perks, resetting
  votes, vote-banning), not on the review queue or on user accounts, so
  they read oddly grouped with either.

• GET /servers/@emojis/flat and GET /servers/@stickers/flat — unnest
  every opted-in server's emojis/stickers into one flat, item-level-paginated
  list (60/page) instead of GET /servers/@emojis's one-page-per-server
  shape, for a cross-server browse page that doesn't grow one section per
  server as more servers opt in.

Fixed

• Animated emojis were synced with a permanently-static CDN URL despite
  animated: true being stored correctly — disgo's Emoji.URL()
  always defaults to PNG regardless of the emoji's animated flag (unlike
  Sticker.URL(), which already inferred the right format from
  FormatType). serversync.go now explicitly requests GIF format when
  Animated is true.
• Server total_members/online_members were only ever set once, at
  /setup time, and never refreshed — there's no periodic member-count
  sync, and the bot deliberately doesn't hold the privileged Server
  Members intent (see TeamCleanup's doc comment), so the gateway's
  cached guild object never gets live count updates either. The existing
  30-minute server-sync task (renamed syncAvatars → syncServerMeta)
  now also REST-polls GetGuild(id, true) per server and updates both
  counts, the same way /setup originally got them.