feat(github): add JIT token API endpoint for agent GitHub access

[sh1nj1]

Summary

Add GET /github/api/token?creative_id=123 endpoint that enables external agents (e.g., OpenClaw) to securely obtain GitHub OAuth tokens at execution time.

Security Checks

1. Write+ permission: Requesting user must have write or higher permission on the creative
2. Ancestor integration: GitHub integration (RepositoryLink) must exist on the creative or one of its ancestors
3. User's own token: Returns the requesting user's own GithubAccount.token (not the integration owner's)

Use Case

abc project (GitHub integration configured)
  └── task1 (user has write access)
        └── Agent requests token with creative_id=task1

Instead of embedding GitHub tokens in prompts/chat context, agents can call this API at execution time:

GH_TOKEN=$(curl -s -H "Authorization: Bearer $COLLAVRE_API_KEY" \
  https://collavre.example.com/github/api/token?creative_id=123 | jq -r .token)

gh pr create --repo owner/repo ...

Files Changed

• engines/collavre_github/app/controllers/collavre_github/api/base_controller.rb — OAuth-based API auth (Doorkeeper)
• engines/collavre_github/app/controllers/collavre_github/api/tokens_controller.rb — Token endpoint with permission/integration checks
• engines/collavre_github/config/routes.rb — Route registration
• engines/collavre_github/test/controllers/collavre_github/api/tokens_controller_test.rb — 7 tests covering auth, permissions, ancestor lookup, and happy path

Tests

All 1291 tests pass (0 failures, 0 errors).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.