fix(discord): fall back to env vars in mergeCredentials when credentials not explicitly set

[tonystrawberry]

Problem

When discordChannel() is used without an explicit credentials option (the common case), scheduled and proactive sessions always get HTTP 401 from Discord.

mergeCredentials returns botToken: undefined when no credentials are passed. callDiscordApi gates the Authorization header on !== undefined, so the block is skipped entirely — no auth header is sent, Discord returns 401. The env var fallback inside resolveDiscordBotToken is never reached.

This only affects scheduled/proactive sessions (e.g. receive(discord, { target, auth: appAuth }) from a schedule handler). Slash command sessions are unaffected because they use an interaction token for the initial deferred reply.

Fix

Default botToken and publicKey to lazy env var readers in mergeCredentials, consistent with how resolveDiscordBotToken already handles the function variant.

Workaround

Until this is patched, pass credentials explicitly to discordChannel():

export default discordChannel({
  credentials: {
    applicationId: () => process.env.DISCORD_APPLICATION_ID!,
    botToken: () => process.env.DISCORD_BOT_TOKEN!,
    publicKey: () => process.env.DISCORD_PUBLIC_KEY!,
  },
});

Fixes #149

[vercel]

@tonystrawberry is attempting to deploy a commit to the Vercel Team on Vercel.

A member of the Team first needs to authorize it.

[tonystrawberry]

Regarding DISCORD_APPLICATION_ID, resolveDiscordApplicationId is called unconditionally and already handles undefined by falling back to process.env.DISCORD_APPLICATION_ID so it's fine here.