[plus] discord role verifier to grant RR plus

.env.example

@@ -141,3 +141,30 @@ RECFLARE_DOMAIN=rec.example.com
 # Setting them both is what opens web signup; with either missing it stays closed. See
 # DEPLOYING.md. Accounts are still created by the game either way, and both `auth` account
 # caps above apply regardless.
+
+# The website's benefits claim (www `/claim`): a player proves a role in your Discord and
+# gets Rec Room Plus. FOUR settings, and ALL FOUR are required — with any missing, the claim
+# stays closed, `/api/config` reports `benefitsEnabled: false`, and the page and its nav link
+# never appear. That is the usual reason "I set the secrets and nothing shows up".
+#
+# The two CREDENTIALS live in the Secrets Store, like the Turnstile pair above:
+#
+#   wrangler secrets-store secret create <store-id> --name DISCORD_CLIENT_ID \
+#     --scopes workers --remote
+#   wrangler secrets-store secret create <store-id> --name DISCORD_CLIENT_SECRET \
+#     --scopes workers --remote
+#
+# The two IDS are plain vars, and go HERE — they are not secrets, and setting the secrets
+# alone is not enough. Both are Discord snowflakes: all digits, no letters, copied with
+# Developer Mode on (right-click the server or role -> Copy ID). Ids, not names.
+#
+# ROLE_IDS is a list and ANY one of them qualifies, so several tiers can share the benefit.
+# SEPARATE THEM WITH COMMAS AND NO SPACES: these knobs are passed to wrangler as `--var`
+# flags that are word-split, so a value containing a space silently breaks the deploy. (The
+# worker itself also accepts whitespace, which is fine in wrangler.jsonc but not here.)
+# RECFLARE_DISCORD_GUILD_ID=1077000000000000000
+# RECFLARE_DISCORD_BENEFITS_ROLE_IDS=1077000000000000001,1077000000000000002
+#
+# Also add https://<your domain>/claim to the app's Redirects in the Discord developer
+# portal, or the exchange is refused. Granting Plus takes effect on the player's NEXT
+# sign-in. `runx admin grant-plus` sets it directly, with no Discord involved.