[auth] allow staff in rollout

.env.example

@@ -238,12 +238,12 @@ RECFLARE_DOMAIN=rec.example.com
 # Discord ROLE ids whose holders may sign in on a ROLLOUT-GATED build — currently
 # `20260323.14`, listed in ROLLOUT_GAME_VERSIONS in packages/domain/src/presence-db.ts. A login
 # posting that build as `ver` is refused ("this build is limited to Discord supporters")
-# unless the account's Discord link holds one of these roles; every other build is never
-# touched. Same rules as ROLE_IDS above: snowflakes, not names; commas, no spaces; ANY one
+# unless the account is staff (developer or moderator — always let in) or its Discord link
+# holds one of these roles; every other build is never touched. Same rules as ROLE_IDS above: snowflakes, not names; commas, no spaces; ANY one
 # qualifies. Roles come from the snapshot the benefits claim and the daily sweep keep, so a
 # player has to have claimed on the website, and a role granted today opens the gate once
 # the sweep runs (or they re-claim). UNSET — or parsing to no roles — CLOSES the gate: nobody
-# signs in on the gated build until a role is named here. Accounts can't be CREATED on a
+# but staff signs in on the gated build until a role is named here. Accounts can't be CREATED on a
 # gated build (a new account has no Discord link); players make one on a released build,
 # link Discord at /claim, and come back.
 # RECFLARE_DISCORD_ROLLOUT_ROLE_IDS=1077000000000000001,1077000000000000002