feat(auth): add admin-managed GitHub App authentication

[bifrost0x]

Summary

• add optional GitHub App authentication configured entirely at runtime in the Admin Panel
• keep GitHub credentials out of Compose, .env, deployment overlays, and additional mounts
• use authorization code flow with PKCE S256, short-lived server-side one-use state, exact callback validation, and immutable numeric GitHub identity bindings
• support explicit stepped-up account linking, optional non-admin auto-provisioning, fail-closed organization allowlists, local MFA completion, and safe unlink recovery
• encrypt the write-only client secret with a domain-separated key and include it in verified offline SECRET_KEY rotation
• add Admin/Security UI, localized account/login labels, security policy updates, and a complete Wiki guide

Security properties

• GitHub usernames and email addresses never select or link local accounts
• access tokens and authorization codes are never persisted or written to audit logs
• provider changes invalidate outstanding OAuth states
• GitHub-provisioned accounts cannot use local password fallback, become the initial administrator, or be promoted
• organization lookup failures and ambiguous provider responses fail closed
• repeated GitHub account step-up starts are rate-limited per user and source IP
• local break-glass administrator access remains independent of GitHub availability

Verification

• Python suite: 2,268 passed, 29 skipped; four loopback-runtime tests were executed separately because the default sandbox denies local socket creation
• focused GitHub/auth/documentation verification: 46 passed
• JavaScript unit tests: 33 passed
• pnpm lint:js
• git diff --check

Deployment impact

No Compose, Docker-secret, or .env changes are required. Existing deployments remain unchanged until an administrator saves a complete GitHub App configuration and enables the provider.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e8e7c85c83

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".