GitHub integration: two-way issue sync

[kaulith]

GitHub Integration Tracking

1. Per-user GitHub OAuth

• Store GitHub access tokens on the GitHub Token doctype instead of Hive Settings. www/github/authorize.py currently writes to the site Single (db_set at lines 59–61), so the last user to connect overwrites everyone else.
• Replace the state parameter with a single-use server-side nonce. It's currently unsigned base64 JSON (authorize.py:20), so it can be forged — an attacker can bind a victim's Hive account to the attacker's GitHub identity. Harmless today because nothing reads the token; exploitable as soon as per-user tokens are wired into writes.
• Make the callback reachable. authorize.py:14 redirects away when state is missing, which is exactly what GitHub's install-time redirect sends (request_oauth_on_install is set in the manifest, and that redirect carries code + installation_id but no state). The file has never executed.
• Switch create_issue from the installation token to the connecting user's OAuth token, so issues are authored by the real GitHub user rather than the bot. Users who haven't connected get a prompt instead of a silent bot-authored issue.
• Add a Connect GitHub account button in Settings so the OAuth flow is actually reachable.
• Drop the now-dead github_access_token, github_username, and github_authorized_at fields from Hive Settings.

2. Multiple GitHub App Installations

• Support selecting the correct GitHub App installation instead of always using installations[0]. Two places hardcode it: github.py:44 in _get_installation_token, and github.py:84 in status().

3. Multi-repository Projects

• Replace Hive Project.github_repo with a child table so a project can be linked to multiple repositories. Six consumers, including orchestrator/service.py:138, which reads it as GIT_REPO for the agent container — that path needs a single repo and has to keep working. Hive Project.github_pat is a separate orchestrator-only token and is out of scope.

5. Webhook Support

• Store the webhook_secret returned by the App manifest conversion. www/github/redirect.py currently drops it, and Hive Settings has no field for it, so signature verification is impossible until both are fixed.
• Add hook_attributes and default_events (issues, issue_comment) to the App manifest in hive_settings.py. GitHub has no API to add a webhook URL to an App after creation, so existing installs must set the URL and secret by hand in GitHub's UI — document that.
• Add a webhook endpoint with signature verification, event dispatch, and idempotency.
• Handle issue opened, edited, closed, reopened, and comment events.
• Add a failed webhook log with retry support so dropped deliveries are visible and replayable.

6. GitHub ↔ Hive Synchronization

• Map GitHub usernames to Hive users for authors and assignees.
• Sync issues, comments, and open/closed state from GitHub → Hive.
• Sync comments and status changes from Hive → GitHub.
• Post a backlink comment on the GitHub issue pointing to the Hive task instead of only embedding the link in the issue body.

7. Future Improvements

• Sync attachments and images.
• Add a unified activity timeline showing both GitHub and Hive events.

§4 depends on §3, §5's dispatch depends on §4, §6 depends on §1 and §4. §1 and §2 are independent.

Related: #164