fix: working on githb token expiring

[callicles]

Note

Medium Risk
Touches GitHub OAuth/session-adjacent flows and adds token refresh/rotation logic plus new user DB columns, which could affect login, authorization checks, and token revocation if misconfigured (e.g., missing GitHub App expiry setting).

Overview
Adds refreshable GitHub App user-token support by storing access+refresh tokens with expiries and a githubTokenKind discriminator in the users table (new migration + schema updates).

OAuth callback now requires GitHub’s expiring user tokens to be enabled, persists the token pair via setUserGithubTokens, and downstream GitHub calls (admin authorization + bypass autocomplete) now obtain tokens through a new getValidUserAccessToken helper that auto-refreshes/rotates tokens with concurrency guards.

Logout now best-effort revokes the user’s GitHub App grant, clears stored token columns, and emits an audit event; Admin/Contributor pages add a re-auth banner when the user is on a legacy/non-refreshable token row. Docs were updated to clarify GitHub App credentials and the required token-expiry setting, and tests were updated/added for token refresh and updated mocks.

^{Reviewed by Cursor Bugbot for commit be1b9da. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-cla-bot-application	Ready	Preview, Comment, Open in v0	May 12, 2026 7:37pm

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bdda7dc. Configure here.}