fix(web): address PR review critical issues for Discord OAuth

- Add V019 migration: rename session_audit_log.actor_telegram_id → actor_external_user_id
- Add CSRF protection to Discord OAuth flow (state cookie with HttpOnly/Secure/Strict)
- Add Discord OAuth env vars to compose.yaml, deploy.yml, and .env.example
- Fix SQL COALESCE for nullable telegram_id in GetGroupManagersAsync and GetSessionParticipantsAsync

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/GmRelay.Web/Services/SessionService.cs

@@ -179,7 +179,7 @@ public sealed class SessionService(
         await using var conn = await dataSource.OpenConnectionAsync();
         return (await conn.QueryAsync<WebGroupManager>(
             """
-            SELECT p.telegram_id AS TelegramId,
+            SELECT COALESCE(p.telegram_id, 0) AS TelegramId,
                    COALESCE(p.external_user_id, p.telegram_id::TEXT) AS ExternalUserId,
                    p.display_name AS DisplayName,
                    p.telegram_username AS TelegramUsername,
@@ -641,7 +641,7 @@ public sealed class SessionService(
         return (await conn.QueryAsync<WebParticipant>(
             """
             SELECT sp.id AS Id,
-                   p.telegram_id AS TelegramId,
+                   COALESCE(p.telegram_id, 0) AS TelegramId,
                    COALESCE(p.external_user_id, p.telegram_id::TEXT) AS ExternalUserId,
                    p.display_name AS DisplayName,
                    p.telegram_username AS TelegramUsername,