[akwirick]

Stacked on #1719. Review and merge #1719 first; GitHub then changes this PR's base to main.

Summary

A member can now click Connect for GitHub in Settings → Credentials and authorize the org's GitHub App to act as them. They do not have to create or paste a personal access token. After connect, engrams knows their GitHub login, so the Reviews "Mine" filter from #1719 works at once.

1. Ask OAuth token endpoints for JSON. GitHub answers the token request in form encoding unless the client asks for JSON, and the coordinator could not read that answer. The token request (code exchange, refresh, and server-side grants) now sends Accept: application/json. This does not change the result for providers that already answer in JSON.
2. Personal OAuth for GitHub.
   • The github_app mint kind gets two optional fields, client_id and client_secret: the App's OAuth client. The admin enters them in the same GitHub setup form. Minting does not use them.
   • A mint connector has no org OAuth facet to reuse. So on a mint connector, userCredential.oauth is now a complete authorization-code flow of its own (oauthFacet). This replaces the parse error "user-to-server OAuth is not implemented".
     • Its token URL may be on an acquisition host, because GitHub exchanges codes on github.com. Adding github.com to hosts would open it to session injection. The org facet keeps the strict rule.
     • A personal flow may name no scopes. GitHub ignores scopes for App user tokens.
   • GitHub's flow asks GET /user: id becomes the account id and login the display name.
   • Settings → Credentials offers Connect only when the org has the App's client id and secret. Without them every member would see a button that can only fail. If the secret listing fails, the button stays, and the flow reports the real error.
   • The GitHub setup panel has an optional Step 5 that shows the callback URL to set on the App. The App manifest now sets callback_urls.
3. Docs: the GitHub guide gets Step 5, the two ways to connect, and the Reviews "Mine" selection.

What sessions get

A profile that acts as the launching person now uses the App user token when the person connected with OAuth. That token has the App's permissions, limited to the person's own access, and does not carry the permissions of a token the person made by hand. GitHub App user tokens expire after 8 hours. The coordinator refreshes them on the same path that refreshes the other personal OAuth credentials.

Upgrade notes

• For admins: to turn this on, open Settings → Integrations → GitHub. Set the App's callback URL to <origin>/api/v1/integrations/github/oauth/callback, generate a client secret, and enter the Client ID and client secret in the optional fields. An App made from the old manifest does not have the callback URL yet.
• If the admin does nothing, the personal token path works as before.

Test plan

• Coordinator oauth_redirect: the token request sends Accept: application/json. oauth_user_credentials passes.
• engram-git-github: the descriptor test pins the two optional fields.
• Workspace: cargo fmt --check, clippy -D warnings and hakari generate --diff pass. In nextest --no-fail-fast, 3223 of 3226 tests pass. The 3 that fail (engram-harness-codex dynamic-tool tests, engram-uffd-handler stalled_alt_source_…) also fail on the base commit in my environment.
• Orchestrator: typecheck. New tests cover the mint-connector personal-flow parse (accepted; refused if true, a non-code grant, or a token host outside the declared hosts), GitHub authorize and callback through the personal flow, and Connect only when both client secrets are set. In the full suite, 2434 tests pass. connector-facets failed once on a 5.5 s timeout and passes alone.
• Web: format, lint, build, and vitest for lib/githubSetup, components/integrations and components/settings
• Site: pnpm build (leak and style lint, astro check)
• Manual: on a deployment with the App's client id and secret set, connect GitHub from Settings → Credentials, confirm that the login shows, and confirm that Reviews → Mine filters to it. After 8 hours, confirm that a session still gets a working token after the refresh.

🤖 Generated with Claude Code

[akwirick]

@engrams-agent Are you able to fix the merge conflicts?