Implement GW2 API v2 guild roster sync (name/rank/join date only)

[avandenberghe]

Summary

Register a bbguild.character_sync-family handler for GW2 that syncs guild roster membership (name, rank, join date) via the guild leader's API key. This is a narrower re-scope of the original ticket — see "What this does NOT cover" below; the per-character sync half was split into a separate ticket since it needs a fundamentally different mechanism (#10).

API

• Base: https://api.guildwars2.com/v2
• Auth: API key from account.arena.net/applications, scoped by permissions (account, guilds). Sent as Authorization: Bearer {key}. No OAuth flow.
• Localization: ?lang=; schema pin: ?v=YYYY-MM-DD.

Endpoints (verified against the current API docs, 2026-09-21)

• /v2/guild/search?name= — resolve guild name → id
• /v2/guild/:id (public) — guild name/tag
• /v2/guild/:id/members — roster: name, rank, joined date only. Requires the guilds scope, and only works with the guild leader's own API key — confirmed there is no way to read an arbitrary guild's roster otherwise.
• /v2/guild/:id/ranks — rank name list

What this does NOT cover

/v2/guild/:id/members does not return class/profession, race, or level — those live on /v2/characters, which is strictly scoped to the API key owner's own account (confirmed against current docs) with no way to look up another player's characters. So this sync can only ever populate name/rank/join-date automatically; class/race/level stay manually-entered per character (same as bbguild already supports for non-API games) until/unless #10's per-member key-linking ships.

Scope

• Register a roster-sync handler; core cron drives it incrementally, rate-limited (GW2 limit ~600 req/min per IP). No synchronous API calls on page load.
• Sync guild members → roster (name, rank, join date) via the guild leader's key.
• ACP: leader API key field + validation.

Component: bbguildgw2. Depends on core sync contract (bbguild#361).