feat: add brokerless GitHub device authentication

[dhruvbhavsar0612]

Summary

Implements upstream issue #340: GitHub OAuth Device Authorization Flow as a local, brokerless alternative to manually creating a PAT.

• Adds a sidecar-owned RFC 8628 flow with opaque UI flow IDs, first/subsequent interval enforcement, slow_down, denial and expiry handling, identity validation, cancellation, and race-safe persistence.
• Keeps GitHub device_code and access tokens out of API responses.
• Persists completed user credentials through the existing local SecretStore while preserving GitHub App relay state.
• Adds a desktop flow with the one-time code, copy/open action, waiting status, cancellation, error/retry states, and PAT fallback.
• Distinguishes local OAuth from PAT authentication in connector status copy.
• Constrains the MCP SDK to <2; MCP 2.0 renamed an API imported by the existing server and otherwise breaks fresh CI collection.

Maintainer setup required

Before enabling this in a production release:

1. Create or select an OpenWorker-owned GitHub OAuth App.
2. Enable Device Flow in the app settings.
3. Set its public client ID as the shipped github_oauth_client_id default. The client ID may be committed; do not add a client secret.
4. Confirm requested scopes. This implementation defaults to repo; add no broader scopes unless a concrete tool requires them.
5. Verify GitHub's authorization page displays the official OpenWorker app identity.

Forks can set github_oauth_client_id and github_oauth_scopes in config.toml. With no client ID, the UI returns an actionable configuration error and makes no GitHub request.

Security and architecture

• Device auth is tools-only user authorization. It does not set mode: relay, create github:install:* records, or replace the GitHub App installation path used for inbound mentions.
• A user credential can coexist with App relay metadata: the explicit credential handles tools while the App continues receiving events.
• No client secret, private key, callback server, redirect handler, or cloud broker is involved.
• Closing or navigating away cancels local flow state; cancellation is linearized against an in-flight successful poll so a canceled flow cannot persist credentials.
• The current SecretStore is a user-restricted local file (0600/Windows ACL), not an OS keyring. A keychain backend remains separate infrastructure work.

Validation

• Backend connector/config/security regressions: 96 passed.
• Frontend unit suite: 79 passed.
• GitHub Playwright suite: 6 passed.
• TypeScript and Vite production build: passed.
• MCP dependency/import check: passed.
• Manual walkthrough: completed using the real UI and sidecar with hermetic GitHub responses because no production OAuth client ID is committed.

github_device_auth_local_flow.mp4