fix: restrict Claude slash auth to bot DMs

[vycdev2]

Summary

• register the Claude /auth command only for one-to-one bot DMs
• reject non-bot-DM interaction contexts at runtime and cover the boundary with a regression test
• document the security fix in the changelog

Verification

• npm run build — passed
• npm test — passed (329 tests)

Risk

• Low: the change only narrows where the privileged Claude authentication slash command can appear and execute.

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.