feat(setpath, use): autocomplete + tilde expansion

[danfranks]

What this PR adds

Two UX wins that users hit on day one:

1. /use alias autocomplete

The alias field now opens a dropdown of all registered projects, formatted as <alias> → <path> with the home dir abbreviated to ~. Users can filter by typing partial alias or partial path.

Before: had to recall / type the alias from memory, error if wrong.
After: open the field, scroll, click.

2. /setpath path autocomplete

The path field scans ~/Projects/ for git repos (one level deep) and offers them as choices. No more typing or recalling absolute paths from a phone.

The alias field on /setpath also gets autocomplete: union of existing registered aliases + names derived from repo dir basenames (with the client- prefix stripped, since that's a common convention).

3. Tilde expansion in /setpath path

Discord passes raw strings into the bot — there's no shell in the middle to expand ~/foo. Today, a user typing ~/Projects/scale-data-cloud gets that exact literal string stored in data.json, which then fails when serveManager tries to spawn opencode against a path that doesn't exist.

This PR adds an expandTilde() helper that resolves ~, ~/foo to absolute homedir-prefixed paths in setpath.execute. Users can mix raw absolute paths and ~ paths interchangeably.

Why these specifically

I just wired the bot up locally, ran the README's example commands, and hit both gotchas in the first 60 seconds:

1. /setpath path:~/Projects/scale-data-cloud succeeded but later failed at execute time because ~ wasn't expanded.
2. /use alias: had no dropdown — required me to remember the exact alias I'd registered.

Both felt like the kind of thing that should "just work."

Implementation notes

• Uses Discord.js's setAutocomplete(true) + an autocomplete() handler. The bot's interactionHandler.ts already dispatches interaction.isAutocomplete() to command.autocomplete, so no changes needed there.
• Filesystem scan happens per-keystroke via readdirSync + existsSync. Cheap on local disk; would need rethinking if the bot ever ran headless on a different machine than the workspace, but the project's design already assumes co-location.
• Discord caps autocomplete results at 25, so I slice(0, 25) after filtering. Names are also slice(0, 100) per Discord's name-length cap.

Tests

All 171 existing tests pass. Build is clean (npm run build, npm test).

Files

src/commands/use.ts     | +24 -1
src/commands/setpath.ts | +71 -7

[RoundTable02]

Thanks for the autocomplete improvements. I found one authorization leak that should be fixed before merge, plus one Discord API limit issue that can make suggestions fail for long paths.

[RoundTable02]

[P1] This autocomplete path now exposes local project metadata before the allowlist check runs. handleInteraction processes autocomplete interactions before isAuthorized, so an unauthorized user in a shared Discord server can type /setpath and receive scanned ~/Projects repo names/paths. Please gate autocomplete interactions with the same allowlist check and return an empty suggestion list for unauthorized users.

[RoundTable02]

[P2] The displayed choice name is capped at 100 characters, but the autocomplete choice value is still the full absolute path. Discord also limits string choice values to 100 characters, so a long repo path can cause interaction.respond(matches) to reject and return no suggestions. Since execution now expands ~, consider using a tilde-relative value when possible and filtering out values that still exceed the limit.