Repo preview returns 502 Bad Gateway when no GitHub token is configured

[Technophobe01]

Repo preview returns 502 Bad Gateway when no GitHub token is configured

Symptom

On a middleman instance with no GitHub token configured, Settings -> Repositories
-> Add repositories... -> Preview (Provider GitHub, Host github.com, any
owner/name) fails. The UI shows a raw POST /repos/preview -> 502, and the API
returns:

{
  "title": "Bad Gateway",
  "status": 502,
  "detail": "no client configured for host github.com",
  "code": "upstreamError",
  "details": { "platformHost": "github.com", "provider": "github" }
}

The request fails in microseconds — no GitHub call is ever made.

Root cause

previewRepos (internal/server/repo_import_handlers.go) calls
s.syncer.ClientForHost(host). With no token configured, no client is registered
for the host, so this returns a "no client configured for host" error, which
providerCallProblem(...) maps to 502 upstreamError.

That mapping is inconsistent with the handler's own stated intent — the comment
just above the GitHub branch says a missing token should surface as a 400
badRequest like the sync and runtime paths, not a 502:

// Provider read failures route through the shared mapping so a
// missing token during token-file rotation surfaces as 400
// badRequest like the sync and runtime paths, not a 502.

The token-file-rotation case may be handled, but the "no client configured at
all" case (a fresh instance that has never had a token) still returns 502.

Impact

A 502 Bad Gateway reads as "the upstream/server is broken," when in fact the
instance simply has no GitHub credentials — a normal first-run state. The error
gives the operator no hint that the fix is to configure a token. This is easy to
hit on any fresh deployment.

Proposed fix

Map the "no client configured for host" / missing-credentials condition to an
actionable 4xx (e.g. 400 badRequest or 422) with a message that points at
token configuration, consistent with the comment's intent. Apply the same to the
non-GitHub RepositoryReader branch so all providers behave the same. A
follow-up could also surface the guidance in the Add-repositories dialog instead
of the raw POST /repos/preview -> NNN line.

Environment

• middleman pg/SQLite server, fresh instance, MIDDLEMAN_GITHUB_TOKEN unset.
• Reproduced against github.com with a private owner/name; unauthenticated
  access to a private repo would fail regardless, but the 502-vs-4xx mapping is
  the reported issue.