fix(api): SSO discovery, channel create and deleted bots (#3390)

fluxer_docs/src/content/docs/http-api/guild-channels.mdx

@@ -137,11 +137,12 @@ A guild holds at most the instance-configured `max_guild_channels` [limit](/http
 
 <RouteHeader method="POST" path="/v1/guilds/{guild_id}/channels" bot auditReason mfa />
 
-Creates a guild channel and returns its [channel object](/http-api/channels/#channel-object) with status 200. Requires [MANAGE_CHANNELS](/http-api/permissions/) at guild level. Emits a [Channel Create](/gateway/events/#channel-create) Gateway event.
+Creates a guild channel and returns its [channel object](/http-api/channels/#channel-object) with status 200. Requires [MANAGE_CHANNELS](/http-api/permissions/) in the parent category when `parent_id` is supplied, and at guild level otherwise. Emits a [Channel Create](/gateway/events/#channel-create) Gateway event.
 
 ### Limitations
 
-- Supplying `permission_overwrites` also requires [MANAGE_ROLES](/http-api/permissions/) at guild level.
+- Supplying `permission_overwrites` also requires [MANAGE_ROLES](/http-api/permissions/) in the same context.
+- Both permissions resolve through the parent category's overwrites. A category overwrite that allows one grants it for that category only, and a category overwrite that denies one blocks a caller who holds it at guild level.
 
 `MANAGE_CHANNELS` is an [elevated permission](/http-api/permissions/#elevated-permissions). It also requires an enrolled multi-factor authenticator when the guild [MFA level](/http-api/guilds/#mfa-levels) is elevated and the caller is not the guild owner.
 
@@ -216,7 +217,7 @@ Only the allowed mask is compared, so a supplied deny is stored without any auth
 | --- | --- | --- |
 | 200 | [channel](/http-api/channels/#channel-object) object | Channel was created |
 | 400<sup>1</sup><sup>2</sup> | [error response](/http-api/#error-response) | Body, type, name, parent, URL, voice setting, or content warning text is invalid, a channel limit is reached, or the caller has no enrolled authenticator in an elevated-MFA guild |
-| 403 | [error response](/http-api/#error-response) | Caller lacks `MANAGE_CHANNELS`, is not a member of the guild, supplied overwrites without `MANAGE_ROLES`, or allowed a permission they do not hold in the parent context, each returning `MISSING_PERMISSIONS` |
+| 403 | [error response](/http-api/#error-response) | Caller is not a member of the guild, lacks `MANAGE_CHANNELS` in the parent category or in the guild when no parent is supplied, supplied overwrites without `MANAGE_ROLES` in that context, or allowed a permission they do not hold there, each returning `MISSING_PERMISSIONS` |
 | 404 | [error response](/http-api/#error-response) | Guild does not exist, returning `UNKNOWN_GUILD` |
 
 <sup>1</sup> A schema or parent failure returns `INVALID_FORM_BODY` and names the field with `CATEGORIES_CANNOT_HAVE_PARENTS`, `INVALID_PARENT_CHANNEL`, or `PARENT_MUST_BE_CATEGORY`. A capacity failure returns the top-level `MAX_GUILD_CHANNELS` or `MAX_CATEGORY_CHANNELS`

fluxer_docs/src/content/docs/operator/reverse-proxy.mdx

@@ -58,6 +58,22 @@ Forward all paths unchanged to the edge. No internal routing changes are needed.
 
 With `FLUXER_PUBLIC_SCHEME=https` the admin CSRF cookie is `__Host-csrf_token`, which browsers accept only over HTTPS.
 
+#### Keep TLS 1.2 enabled
+
+The Android and iOS apps play video through a media library whose TLS stack offers only TLS 1.2. The rest of each app uses the system TLS stack. Behind a proxy that accepts only TLS 1.3 the apps sign in and load messages and images, but every video fails with "Could not play this video."
+
+Accept TLS 1.2 alongside TLS 1.3. TLS 1.2 can stay limited to ECDHE key exchange with AES-GCM or ChaCha20-Poly1305, which the apps support.
+
+| Proxy | Setting |
+| --- | --- |
+| nginx | `ssl_protocols TLSv1.2 TLSv1.3;` |
+| Caddy | `protocols tls1.2 tls1.3` |
+| Traefik | `minVersion: VersionTLS12` |
+| HAProxy | `ssl-min-ver TLSv1.2` |
+| Apache httpd | `SSLProtocol -all +TLSv1.2 +TLSv1.3` |
+
+Caddy and Traefik accept both versions by default, so their rows apply only where a `tls` block or a TLS option already sets a floor. The HAProxy keyword goes on the `bind` line. On Cloudflare, keep Minimum TLS Version at 1.2 or lower. The bundled edge accepts both versions.
+
 #### Forward WebSocket upgrades
 
 The client connection is on `/gateway` and voice signalling is on `/livekit/*`. Both open as WebSocket upgrades. Check that the handshake completes through whatever is in front of the instance, with your own hostname in place of `chat.example.com`: