GitHub App integration: repo links, commit/PR deep links, status from merges

Linear-style GitHub integration — connect repos to a workspace so commits/PRs deep-link to issues and merges drive status. Shipped to develop (tesks + tesks-ui), awaiting deploy + App setup (see rollout task).

Inbound (verified webhooks) — tesks

• POST /github/webhook (GithubWebhookController) — outside the bearer-guarded /api/**; verifies X-Hub-Signature-256 HMAC over the raw body, de-dupes on X-GitHub-Delivery (github_delivery).
• GithubWebhookService — resolves tenant from the installation id, scans commit/PR/branch text via IssueRefScanner (reuses the KEY-NUMBER shape; alias-aware so a ENG-12 mention still links after the issue moved to DSN-4), upserts issue_dev_link rows + issue_event activity (fans out to Discord via the existing ActivityDispatcher), and applies per-repo automation: PR open → status, PR merge → status, fixes ENG-1 on the default branch → close. Transitions resolve the configured status's category into the issue's own team, so one mapping works across teams.

Write-back (optional) — GithubAppClient mints an RS256 app JWT → installation token to comment on PRs / set commit status; GithubActivitySink mirrors issue status changes onto linked PRs. No-op when app id/key unset.

Config / schema — migration V14 (github_install, repo_link, issue_dev_link, github_delivery); GithubApiController /api/w/{slug}/github/**; tesks.github.* (app id / private key / webhook secret).

UI — tesks-ui — Settings → GitHub (connect installation, link repos with default team / project / PR-open & PR-merge → status + autolink/closes toggles); issue Development panel listing linked PRs/commits/branches; new commit/pr/branch activity events.

Tests — signature verify, ref scanner, through-the-DAL webhook handling (push-close, PR open/merge transitions, dev links, install scoping, dedupe). Backend + UI suites green.

Commits: tesks 2a2b296, tesks-ui 62e12f9.