Bug Description

DISCORD_ALLOW_BOTS=mentions (or all) has no practical effect because the authorization check in _is_user_authorized() runs before the bot filter in the Discord platform adapter, rejecting bot messages with Unauthorized user before the bot filter is ever reached.

Steps to Reproduce

1. Set DISCORD_ALLOW_BOTS=mentions in .env
2. Have a Discord bot/webhook user send a message that mentions the Hermes bot
3. Observe WARNING gateway.run: Unauthorized user: <bot_id> in the logs
4. Hermes does not respond

Expected Behavior

DISCORD_ALLOW_BOTS=mentions should be sufficient to allow bot messages that mention Hermes, without requiring the bot's user ID to also be in DISCORD_ALLOWED_USERS.

Actual Behavior

The authorization check in gateway/run.py:_is_user_authorized() rejects the message before the DISCORD_ALLOW_BOTS check in gateway/platforms/discord.py (line ~555) is reached.

Proposed Fix

In _is_user_authorized(), skip the allowlist check for bot messages when DISCORD_ALLOW_BOTS is set to mentions or all. Alternatively, move the bot filter check upstream before the authorization check, or have _is_user_authorized() return True for bots when the allow-bots policy permits it.

Environment

• Bazzite Linux, Hermes running inside Ubuntu Distrobox
• Discord gateway platform
• Triggered by a Cloudflare Worker webhook posting Notion events to a Discord channel