docs: address PR review comments

- Fix /logs permission: Administrator -> Manage Messages (full-documentation.md, api-reference.md)
- Fix regex description: 4-20 alphanumeric -> 12/16-char with symbols/hyphens
- Fix code detection example: IDLE2024 (8-char) -> ABCD1234EFGH (12-char valid format)
- Fix schema field names: timestamp/loot -> redeemed_at/loot_detail/created_at
- Fix debug log cleanup period: 7 days -> 1 hour (debug/), 1 day (api-logs/)

Signed-off-by: Michael Cramer <michael@bigmichi1.de>

Author: BigMichi1

docs/api-reference.md

@@ -843,7 +843,7 @@ Show the last N lines of the bot's combined log file. Admin only.
 |-----------|------|----------|-------------|
 | `lines` | integer | No | Number of log lines to show (1-100, default: 20) |
 
-**Permissions**: Requires the `Administrator` permission on the Discord server.
+**Permissions**: Requires the `Manage Messages` permission on the Discord server.
 
 **Response Format** (Ephemeral):
 ```
@@ -861,7 +861,7 @@ Show the last N lines of the bot's combined log file. Admin only.
 
 | Error | Cause | Resolution |
 |-------|-------|-----------|
-| `PERMISSION_DENIED` | User is not an administrator | Requires Administrator permission |
+| `PERMISSION_DENIED` | User lacks Manage Messages permission | Requires Manage Messages permission |
 | `LOG_NOT_FOUND` | Log file does not exist | Bot has not run long enough to create logs |
 
 ---
@@ -941,7 +941,7 @@ The bot automatically scans all messages in the monitored channel for promo code
 
 **Trigger**: Message posted in monitored Discord channel
 
-**Pattern Matching**: Regular expression matching 4-20 alphanumeric character sequences
+**Pattern Matching**: Regular expression matching 12- or 16-character sequences of uppercase alphanumeric and symbol characters (optionally hyphen-separated)
 
 **Detection Pattern**:
 ```regex
@@ -962,15 +962,15 @@ Does NOT match:
 **Detection Behavior**:
 
 ```
-Message Posted: "Free code: IDLE2024"
+Message Posted: "Free code: ABCD1234EFGH"
                         ↓
 Bot scans message content
                         ↓
-Pattern matches: IDLE2024
+Pattern matches: ABCD1234EFGH
                         ↓
 Retrieves message author credentials
                         ↓
-Calls API: redeemCoupon(IDLE2024)
+Calls API: redeemCoupon(ABCD1234EFGH)
                         ↓
 Records result in database
                         ↓

docs/full-documentation.md

@@ -258,7 +258,7 @@ Show the last N lines of the bot's combined log file.
 
 - **Optional parameters:**
   - `lines` – Number of log lines (1–100, default: 20)
-- **Permissions:** Requires Discord `Administrator` permission
+- **Permissions:** Requires Discord `Manage Messages` permission
 - **Returns:** Ephemeral embed with log content
 - **Example:** `/logs` or `/logs lines:50`
 

docs/system-design.md

@@ -185,9 +185,9 @@ The bot reads promo codes from Discord messages, redeems them via the Idle Champ
 
 **Tables**:
 - **users** - User credentials (Discord ID, encrypted user_id, encrypted hash, notification preferences, autoRedeem)
-- **redeemed_codes** - Code history (code, redeemer, timestamp, status, loot, is_public, expires_at)
+- **redeemed_codes** - Code history (code, discordId, redeemed_at, status, loot_detail, is_public, expires_at)
 - **pending_codes** - Codes detected but not yet redeemed by the finder
-- **audit_log** - Operation tracking (action, details, timestamp per user)
+- **audit_log** - Operation tracking (action, details, created_at per user)
 - **backfill_operations** - Backfill run history & global lock (status: in_progress/completed/failed)
 - **loot_totals** - Aggregate loot cache (per-user and server-wide counts for `/stats`)
 
@@ -204,7 +204,7 @@ The bot reads promo codes from Discord messages, redeems them via the Idle Champ
 - **Locality**: No network dependency
 - **Isolation**: Each user's data accessible only via their Discord ID
 - **Encryption**: User credentials encrypted with AES-256-GCM at rest
-- **Cleanup**: Debug logs auto-deleted after 7 days
+- **Cleanup**: Debug files (`debug/`) deleted after 1 hour; API request logs (`api-logs/`) deleted after 1 day
 
 ---