Discord verification API

Flow

1. Joi calls POST /api/discord/verify/start with guild and Discord user IDs.
2. The backend returns a one-time code and a /verify?code=... URL.
3. The browser loads GET /api/discord/verify/challenge?code=....
4. The browser calls POST /api/discord/verify/prepare with the wallet address and key hash.
5. The wallet signs the returned payload.
6. The browser calls POST /api/discord/verify/complete with the signature.
7. The backend verifies the signature and checks for at least one ADA Handle on the connected payment address.
8. Joi polls GET /api/discord/verify/pending and assigns roles.
9. Joi acknowledges each result with POST /api/discord/verify/ack.

Security

• One-time code, short expiry.
• Challenge bound to guild, Discord user, address and key hash.
• Payment key and network checks.
• Unique wallet per guild.
• 180-day retention; weekly Hodler recheck.
• No signature persistence.