feat(github-app): App credentials, installation tokens, and a Select repo picker (#621)

* feat(github-app): App credentials, installation tokens, and a Select repo picker

RoboCo was 100% PAT-based. A singleton Fernet-encrypted github_app_credentials
row (migration 077, telegram-credentials pattern) now stores the App id +
private key; github_app_auth mints RS256 app JWTs and caches installation
tokens until 5 minutes before expiry. Projects can bind an installation
(projects.github_installation_id): get_decrypted_token returns a minted
installation token for bound projects and falls back to the stored PAT on
any minting failure, so all ten token consumers work unchanged.

CEO-gated routes expose credentials CRUD plus installation/repo listing, and
the New Project dialog gains a Select repo picker (disabled with a HelpTip
until the App is configured) that fills the git URL and binds the
installation; manual URL + PAT stays the default path.

* test(panel): mock the GitHub App credentials card in the settings page test

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

tests/integration/test_github_app_credentials_service.py

@@ -0,0 +1,96 @@
+"""GitHubAppCredentialsService coverage — plain app_id, encrypted private key,
+all-or-nothing set/clear (mirrors ``test_telegram_credentials_service.py``).
+
+Drives a real ``db_session`` via the project's Postgres-backed conftest.
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+import pytest
+import pytest_asyncio
+from roboco.db.tables import GitHubAppCredentialsTable
+from roboco.services.github_app_credentials import (
+    GitHubAppCredentialsService,
+    GitHubAppCredentialsValidationError,
+    get_github_app_credentials_service,
+)
+from sqlalchemy import select
+
+if TYPE_CHECKING:
+    from collections.abc import AsyncIterator
+
+    from sqlalchemy.ext.asyncio import AsyncSession
+
+_CREDS = {
+    "app_id": "123456",
+    "private_key": "-----BEGIN PRIVATE KEY-----\nfake-pem\n-----END PRIVATE KEY-----",
+}
+
+
+@pytest_asyncio.fixture
+async def svc(
+    db_session: AsyncSession,
+) -> AsyncIterator[GitHubAppCredentialsService]:
+    yield get_github_app_credentials_service(db_session)
+
+
+@pytest.mark.asyncio
+async def test_unset_has_no_credentials(svc: GitHubAppCredentialsService) -> None:
+    assert await svc.has_credentials() is False
+    assert await svc.get_decrypted() is None
+
+
+@pytest.mark.asyncio
+async def test_set_both_stores_and_roundtrips(
+    svc: GitHubAppCredentialsService,
+) -> None:
+    has_creds = await svc.set_credentials(**_CREDS)
+    assert has_creds is True
+    assert await svc.has_credentials() is True
+
+    decrypted = await svc.get_decrypted()
+    assert decrypted is not None
+    assert decrypted.app_id == _CREDS["app_id"]
+    assert decrypted.private_key == _CREDS["private_key"]
+
+
+@pytest.mark.asyncio
+async def test_app_id_stored_plain_key_encrypted(
+    svc: GitHubAppCredentialsService, db_session: AsyncSession
+) -> None:
+    await svc.set_credentials(**_CREDS)
+    result = await db_session.execute(select(GitHubAppCredentialsTable).limit(1))
+    row = result.scalar_one_or_none()
+    assert row is not None
+    assert row.app_id == _CREDS["app_id"]
+    assert row.private_key_encrypted != _CREDS["private_key"]
+
+
+@pytest.mark.asyncio
+async def test_clearing_both_removes_row(svc: GitHubAppCredentialsService) -> None:
+    await svc.set_credentials(**_CREDS)
+    has_creds = await svc.set_credentials(app_id="", private_key="")
+    assert has_creds is False
+    assert await svc.has_credentials() is False
+    assert await svc.get_decrypted() is None
+
+
+@pytest.mark.asyncio
+async def test_partial_set_is_rejected(svc: GitHubAppCredentialsService) -> None:
+    with pytest.raises(GitHubAppCredentialsValidationError):
+        await svc.set_credentials(app_id="only-one", private_key="")
+
+
+@pytest.mark.asyncio
+async def test_rotate_overwrites_previous_values(
+    svc: GitHubAppCredentialsService,
+) -> None:
+    await svc.set_credentials(**_CREDS)
+    rotated = {"app_id": "654321", "private_key": _CREDS["private_key"] + "-rotated"}
+    await svc.set_credentials(**rotated)
+    decrypted = await svc.get_decrypted()
+    assert decrypted is not None
+    assert decrypted.app_id == rotated["app_id"]
+    assert decrypted.private_key == rotated["private_key"]