fix: make trigger list public and ephemeral, fix rolesetup types, and improve bot safety

- Make /trigger list and help public subcommands with ephemeral replies
- Restrict /trigger add and remove to moderators/admins
- Use Unicode-aware regex and strip URLs before trigger word matching
- Ensure guild_settings exist before UPDATE queries in welcome and log commands
- Fix rolesetup edit neue_rolle type to addRoleOption and prevent label truncation
- Reset select menu components after selection so users can re-click same options
- Validate Twitch streamers via Helix Users API and prevent interaction timeouts with deferReply
- Connect TwitchMonitor automatically on startup and when first channel is added
- Add moderation role-hierarchy checks to admin commands and enforce timeout limits
- Disable DM execution on server-bound commands to prevent SQLite null constraint errors
- Update README.md and AGENTS-BOT.md with new constraints and command documentation

AGENTS-BOT.md

@@ -158,3 +158,9 @@ if (process.env.AUTO_DEPLOY !== 'false') {
 11. **Select Menu Emoji Handling:** Never pass an empty string `''` to `setEmoji()`. Only call `setEmoji()` when a valid, non-empty emoji string is provided.
 12. **Team Application Owner Support:** When checking bot owner status, check `process.env.BOT_OWNER_ID` or test if `client.application.owner` is a `Team` object with `owner.members.has(userId)`.
 13. **Stopwatch Duplicate Prevention & Custom Start Time:** When creating stopwatches, perform a case-insensitive name uniqueness check per user/guild (`LOWER(name)`). Validate custom start times (`startzeit`) to ensure they do not lie in the future.
+14. **Public vs. Mod Subcommands & Ephemeral Output:** For commands offering both public query options and mod-only actions (e.g. `/trigger`, `/timer`, `/twitch`), do not set `defaultMemberPermissions` on the root SlashCommandBuilder if subcommands like `list` or `help` should be public. Check `isAdmin` inside mutating subcommands (`add`, `remove`), and deliver `list`/`help` subcommands with `ephemeral: true`.
+15. **Server-Bound Commands & DM Isolation:** Commands relying on guild context (`guildId`, roles, settings) must enforce `.setDMPermission(false)` and validate `if (!interaction.guildId) return;` to prevent SQLite null constraint errors in direct messages.
+16. **Guild Settings Provisioning:** Before issuing raw SQL updates on `guild_settings`, call `client.DB.getSettings(guildId)` to ensure the guild settings record exists in SQLite.
+17. **Unicode-Safe Trigger Matching & URL Filtering:** In `messageCreate`, strip URLs before matching auto-responses and use Unicode property escapes (`(?<![\p{L}\p{N}_])...(?![\p{L}\p{N}_])` with `iu`) to handle umlauts and avoid URL false positives.
+18. **Role Option Select Menus & Typing:** Subcommand options taking a Discord role to edit must use `.addRoleOption()`. After role select interactions, re-render/reset components so users can click the same option again to toggle or remove it.
+19. **Twitch Helix User Validation & Interaction Deferral:** Commands validating Twitch streamers must use `interaction.deferReply()` to avoid 3-second interaction timeouts and validate user accounts via the Helix Users API (`/helix/users`).