feat(server): add GitHub OAuth provider

[jgpruitt]

Summary

• Add GitHub OAuth provider implementation for device flow authentication
• GitHub tokens don't expire (no refresh token unlike Google)
• Fetch primary email from /user/emails endpoint when email is not public on profile

Changes

• New file: packages/server/auth/providers/github.ts

  • getGitHubConfig() - returns client ID and scopes (read:user, user:email)
  • buildGitHubAuthUrl() - constructs GitHub authorization URL
  • exchangeGitHubCode() - exchanges authorization code for access token
  • fetchGitHubUserInfo() - fetches user profile and email
  • fetchGitHubPrimaryEmail() - helper to get primary email from emails endpoint

• Updated: packages/server/auth/providers/index.ts

  • Route all provider switch statements to GitHub functions

• Updated: packages/server/handlers/auth.ts

  • Remove "GitHub not implemented yet" error check

Testing

All 234 existing tests pass. The OAuth callback handler was already generic enough to handle both providers - no changes needed there.

Notes

• GitHub OAuth apps (vs GitHub Apps) don't provide refresh tokens
• GitHub access tokens don't expire unless explicitly revoked
• The expiresAt field is set to null for GitHub tokens to reflect this