feat(github): synthetic OAuth refresh flow for MINT_REPO_TOKEN

[tlgimenes]

MINT_REPO_TOKEN now mints the short-lived ghs_ token and issues a durable, revocable synthetic refresh token (ghr_<grantId>.<secret>, an MCP-issued repo grant — not a GitHub refresh token), returning refreshToken/tokenEndpoint/clientId while keeping all legacy output fields. Two new unauthenticated endpoints — POST /repo-grant/token (re-mints a repo-scoped token via a GitHub App JWT; permanent 400 invalid_grant vs transient 503 so the mesh never discards a valid grant) and POST /repo-grant/revoke (RFC 7009) — redeem/revoke grants using only App credentials, with no user-to-server token at refresh time. Grants persist in a new REPO_GRANTS Cloudflare KV namespace storing only sha256(secret) (constant-time verified) with a sliding 90-day TTL, namespaced under /repo-grant/* to avoid the runtime's /oauth/* routes. The change is fully backward compatible and covered by 86 passing tests with a clean typecheck and dry-run build. ⚠️ Before this deploys, create the real namespace (cd github && bunx wrangler kv namespace create REPO_GRANTS) and replace the placeholder id in wrangler.toml, or the post-merge wrangler deploy will fail.

🤖 Generated with Claude Code

---

Summary by cubic

Adds a synthetic OAuth-style refresh flow to MINT_REPO_TOKEN. We still mint the short-lived GitHub ghs_ token, and now also return a durable, revocable repo grant (ghr_<grantId>.<secret>) with a tokenEndpoint and clientId so refresh needs only the GitHub App, not a user token.

• New Features

  • MINT_REPO_TOKEN now returns refreshToken, tokenEndpoint, clientId, refreshTokenExpiresAt, expiresIn, tokenType, and repository.id (keeps all legacy fields).
  • New endpoints: POST /repo-grant/token (redeems refresh_token) and POST /repo-grant/revoke (RFC 7009). Unauthenticated, size-limited, and map GitHub 422/404 → 400 invalid_grant and 401/5xx → 503 temporarily_unavailable.
  • Grants persist in REPO_GRANTS KV with SHA-256 secret hashing, constant-time verify, and a sliding 90-day TTL. PUBLIC_BASE_URL sets the absolute tokenEndpoint.
  • mintRepoScopedToken accepts optional repositoryId, cross-checks it, and returns repositoryId.

• Migration

  • Create and bind the KV namespace: bunx wrangler kv namespace create REPO_GRANTS, then replace the placeholder id in wrangler.toml.
  • Optionally set PUBLIC_BASE_URL to your public origin; defaults to https://github-mcp.decocms.com.

^{Written for commit 4770d2e. Summary will update on new commits.}