Document and test OctocrabAppClient concurrency model for installation-token acquisition

[coderabbitai]

Summary

OctocrabAppClient is used across async tasks for installation-token acquisition without documented concurrency guarantees or concurrent-scenario tests.

Motivation

The PR introduces async token acquisition code that may be shared across concurrent tasks. Without documented Send + Sync guarantees and concurrent test coverage, there is a risk of subtle data races or incorrect assumptions by callers.

Proposed change

1. Add a doc comment to OctocrabAppClient in src/github/installation_token.rs (or src/github/mod.rs) explaining its concurrency model and confirming Send + Sync safety.
2. Add unit tests using tokio::spawn to exercise concurrent calls to acquire_installation_token on a shared OctocrabAppClient.
3. Add a BDD scenario in tests/features/github_installation_token.feature (and corresponding step definitions) for concurrent token requests and cancellation mid-acquisition.

Acceptance criteria

• OctocrabAppClient carries a doc comment explaining its concurrency model.
• At least one unit test exercises concurrent token acquisition via tokio::spawn.
• At least one BDD scenario covers concurrent or cancelled acquisition.
• make check-fmt, make lint, and make test all pass.

Background

Identified during review of PR #77 (requested by @leynos).