feat(guild): change_role atomic transfer + friend_list

- ChangeRoleAsync: Leader-only role management with SubLeader cap check.
  Atomic leader transfer loads both member rows + Guild.LeaderViewerId in
  one _db.SaveChangesAsync call (no split saves). Emits ChangeLeader (6)
  or ChangeSubLeader (7) chat events. Same-role is no-op / returns Ok.
- /guild/change_role controller: calls ChangeRoleAsync, returns full updated
  member list (GuildChangeRoleResponse.Members[]).
- /guild/friend_list controller: calls IFriendService.GetFriendsAsync, then
  annotates each friend with is_join_guild from Viewer.GuildId column.
- IGuildRepository.UpdateLeaderViewerIdAsync: added for completeness even
  though the atomic transfer path bypasses it via direct EF mutation.
- Tests: 8 GuildServiceChangeRoleTests (role changes, cap, atomic transfer,
  no-op, permission); 3 GuildChangeRoleFriendListFlowTests (HTTP roundtrip,
  is_join_guild); 2 GuildWireShape tests (literal JSON shape); 1508 pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

SVSim.Database/Repositories/Guild/GuildRepository.cs

@@ -95,4 +95,12 @@ public sealed class GuildRepository : IGuildRepository
         guild.EmblemId = emblemId;
         await _db.SaveChangesAsync(ct);
     }
+
+    public async Task UpdateLeaderViewerIdAsync(int guildId, long newLeaderViewerId, CancellationToken ct = default)
+    {
+        var guild = await _db.Guilds.FirstOrDefaultAsync(g => g.GuildId == guildId, ct);
+        if (guild is null) return;
+        guild.LeaderViewerId = newLeaderViewerId;
+        await _db.SaveChangesAsync(ct);
+    }
 }