fix(github-app): PAT fallback covers every mint failure; video/motion/x cleanups

mint_installation_token now wraps JWT build + HTTP + parsing so raw
httpx/jwt failures surface as GitHubAppError and the existing PAT
fallback catches them all (a GitHub outage no longer crashes git
operations for App-bound projects). The PEM is validated at
credential-set time instead of first mint, and the installation-token
cache is cleared when credentials are deleted. Also: the video
preview root resolves symlinks like its sibling route (frames under a
symlinked workspaces_root no longer false-404), the tracked dangling
motion/node_modules symlink is removed and the gitignore gains a
slash-less entry that actually matches symlinks, changelog caption
input strips GHSA refs like PR refs, and the edit-project dialog hides
the GitHub App section for auto-detected gitlab.com projects and warns
before a save that would clear both auth sources.

.gitignore

@@ -107,6 +107,10 @@ panel/.env.*.local
 
 # motion/ (HyperFrames compositions) + video-renderer (its render sidecar)
 motion/node_modules/
+# the trailing-slash form above only matches a directory — a tracked
+# symlink at this path (e.g. a container-absolute pnpm link) needs its own,
+# slash-less entry or it slips through `git add`/`git status` untracked.
+motion/node_modules
 video-renderer/node_modules/
 # hyperframes lint/preview generates index.html in each composition dir —
 # regenerated locally as needed, not tracked (the sidecar renders