feat(official-bots): resolve tournament bot token from Redis and account service

On startup, TournamentBotGamePlayer now resolves the bot token via
a three-tier fallback: account service (fresh, validates against current
DB) → Redis cache (shared across pod instances) → TOURNAMENT_BOT_TOKEN
env var. Fetched tokens are written to Redis so sibling pods skip the
account service call.

joinTournament gains the same Redis fallback so join calls succeed even
when TOURNAMENT_BOT_TOKEN is not set in the environment.

Adds GET /api/account/official-bots/{name}/token (InternalOnly) to the
account service, backed by AccountService.getOfficialBotTokenByName.
AccountServiceClient gains a matching getBotToken method.

TournamentBotConfig.fromEnvWithToken accepts a pre-resolved token so the
env var is no longer required when a token can be sourced elsewhere.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/account/src/main/scala/de/nowchess/account/resource/AccountResource.scala

@@ -193,6 +193,14 @@ class AccountResource:
     val bots = accountService.getOfficialBotAccounts()
     Response.ok(bots.map(toOfficialBotDto)).build()
 
+  @GET
+  @Path("/official-bots/{name}/token")
+  @InternalOnly
+  def getOfficialBotToken(@PathParam("name") name: String): Response =
+    accountService.getOfficialBotTokenByName(name) match
+      case None        => Response.status(Response.Status.NOT_FOUND).build()
+      case Some(token) => Response.ok(RotatedTokenDto(token)).build()
+
   @POST
   @Path("/official-bots")
   @RolesAllowed(Array("Admin"))

modules/account/src/main/scala/de/nowchess/account/service/AccountService.scala

@@ -225,6 +225,9 @@ class AccountService:
   def getOfficialBotAccounts(): List[OfficialBotAccount] =
     officialBotAccountRepository.findAll()
 
+  def getOfficialBotTokenByName(name: String): Option[String] =
+    officialBotAccountRepository.findByName(name).map(_.token)
+
   @Transactional
   def deleteOfficialBotAccount(botId: UUID): Either[AccountError, Unit] =
     officialBotAccountRepository.findById(botId) match