feat: demote members who miss the code of conduct deadline

[jaspermayone]

Summary

After the deadline, members who were asked and still have not accepted move back to single-channel guests in the code-of-conduct channel. From there they go through the same flow as a new member. Slack admins and owners cannot be demoted, so they get their own request with a box they must check.

flowchart LR
  A[Full member, asked, no acceptance] -->|slack:coc:demote CONFIRM=1| B[DemoteForCodeOfConductJob]
  B -->|member| C[users.admin.setUltraRestricted: single-channel guest]
  C --> D[DM + email: you are now a guest]
  D -->|accept| E[users.admin.setRegular: full member again]
  B -->|Slack admin or owner| F[DM with form button + email]
  F -->|check the box| G[Accepted]

Loading

Changes

• SlackService#demote_to_guest uses the undocumented users.admin.setUltraRestricted endpoint, with the same xoxc/xoxd auth as promote_to_member.
• SlackService#workspace_admin? finds Slack admins and owners.
• New DemoteForCodeOfConductJob: demotes a member, sets slack_membership to pending, and sends a DM and an email. For a Slack admin, it sends the admin request instead.
• Exempt users (users.code_of_conduct_exempt) are not demoted.
• New rake task slack:coc:demote (preview unless CONFIRM=1; ASKED_BEFORE=, default 14 days ago).
• New docs/CODE_OF_CONDUCT.md with the runbook.

Risk

I have not tested users.admin.setUltraRestricted against a live workspace. The endpoint name and its channel parameter follow the legacy admin API. Test it on one account before you run the task for everyone.

Test plan

• bundle exec rspec
• bin/rubocop
• Demote one test account. Check that it lands in the code-of-conduct channel and that accepting promotes it again.
• Run the job for one Slack admin. Check that the form needs the box.