feat(recon): let GITHUB_TOKEN lift the GitHub recon rate limit

[tsstod]

Summary

The RECON GitHub Recon tool calls api.github.com with no credentials, so a deployment shares GitHub's anonymous allowance of 60 requests per hour per IP across every visitor. A handful of lookups exhausts it, and the route then reports the 403 as a generic "GitHub lookup failed" with no hint that waiting is the fix.

This sends an Authorization header when GITHUB_TOKEN is set, which raises the limit to 5,000 requests per hour. It stays optional: with no token the tool behaves exactly as before, which is how the public demo runs.

Changes

• src/app/api/osint/github/route.ts builds the request headers once and adds Authorization: Bearer $GITHUB_TOKEN when the variable is set. Both GitHub calls (profile and recent repos) use them.
• .env.example documents GITHUB_TOKEN in its own block beside the other keys the code actually reads. It notes that the token needs no scopes, since profile and repo data are public.

Testing

Checked against the running dev server:

Condition	Result
No token	200 with full profile and 5 recent repos
Missing user param	400 Missing username parameter
Unknown user	404 User not found
Deliberately fake GITHUB_TOKEN	502 with detail: "GitHub API HTTP 401"

The 401 is what proves the header is attached: GitHub only rejects a request that carries credentials. Before this change the same request returned 200.

Full npx vitest run passes on a local branch combining this PR with #334 and #338 on current master (8781ae3): 49 test files passed, 614 tests passed. The 2 skipped files and 16 skipped tests are pre-existing skips of the network-gated tests. No unit test added for the header itself; the live check above covers it.

Notes

• Independent of feat(ai): run the AI analyst through any Gemini-compatible gateway #334 and fix(ui): keep every tool-strip flyout inside the window #338: this touches only the GitHub route and .env.example. feat(ai): run the AI analyst through any Gemini-compatible gateway #334 also edits .env.example, but a different block, and the three merge cleanly together.
• The file header in .env.example still says the code "only actually reads SCANNER_URL and SCANNER_KEY". That was already out of date for CLOUDFLARE_API_TOKEN, ETHERSCAN_API_KEY and HELIUS_API_KEY; I left it alone to keep this PR focused.
• A rate-limited response still surfaces as the generic 502. Distinguishing it (403 with x-ratelimit-remaining: 0) would be a small follow-up.

🤖 Generated with Claude Code

[vercel]

@tsstod is attempting to deploy a commit to the Developing Osiris' projects Team on Vercel.

A member of the Team first needs to authorize it.

[tsstod]

The red Vercel – osiris check here is Vercel waiting for a team member to authorize a deploy from a fork. No build has run, so here's a local one instead:

• npm run build passes (Next 16.3.4, exit 0) on a local branch combining this PR with feat(ai): run the AI analyst through any Gemini-compatible gateway #334 and fix(ui): keep every tool-strip flyout inside the window #338 on current master (8781ae3). next.config.ts sets typescript.ignoreBuildErrors: false, so the build's type check passed too.
• npx vitest run passes on the same branch: 49 test files and 614 tests. The 16 skipped tests are the existing network-gated ones.

🤖 Generated with Claude Code