feat(github): rewrite plugin with OAuth Device Flow

[wrxck]

Summary

• Rewrites the minimal GitHub plugin (75 lines, repo info only) into a full integration (770 lines) with OAuth Device Flow authentication, 11 subcommands, paginated list views, and cron-based auth polling
• Adds GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET to .env.example
• Adds comprehensive test suite (73 tests) covering all handlers, cron polling, callback queries, and error handling

Commands

Command	Description	Auth
/gh login	Start Device Flow OAuth (PM only)	No
/gh logout	Revoke + delete stored token (PM only)	Yes
/gh me	Show authenticated user profile	Yes
/gh repos [user]	List repos (own or specified user)	Yes
/gh owner/repo	View repo info (uses token if available)	No*
/gh issues owner/repo	List open issues	No*
/gh issue owner/repo#123	View specific issue	No*
/gh starred	List starred repos	Yes
/gh star owner/repo	Star a repo	Yes
/gh unstar owner/repo	Unstar a repo	Yes
/gh notifications	View unread notifications	Yes

Key design decisions

• OAuth Device Flow (RFC 8628): no web server needed — user gets a code to enter on github.com, cron polls for completion
• Redis-backed state: tokens (github:token:{uid}, 1yr TTL), pending device flows (github:device:{uid}, 15min TTL), pending set for cron enumeration
• Pagination: callback query buttons with short prefixes (r:, i:, s:, n:) to stay within Telegram's 64-byte callback data limit
• Cron safety: respects GitHub's interval field, handles slow_down responses, caps at 10 polls per tick, cleans up expired flows

Test plan

• busted spec/plugins/utility/github_spec.lua — 73/73 pass
• busted — 668/668 pass (no regressions)
• Manual: configure OAuth app, test /gh login flow end-to-end
• Manual: verify pagination buttons work in Telegram