docs(metricsai): note least-privilege fine-grained GitHub PAT in QUICKSTART (#30)

QUICKSTART only said "GitHub token" with no scoping guidance. Add a
least-privilege note mirroring the AWS block: use a fine-grained PAT scoped
to only the selected repos with three Read-only permissions (Metadata, Pull
requests, Issues), linking to the full README setup.

Co-authored-by: Brian Hodges <bhodges@navapbc.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

metricsai/QUICKSTART.md

@@ -18,6 +18,11 @@ uv run metricsai --set-webhook-key   # webhook API key (to post)
 
 Or via env: `METRICSAI_GITHUB_TOKEN`, `METRICSAI_WEBHOOK_KEY`.
 
+**GitHub least privilege:** use a **fine-grained** PAT, not a classic token. Scope it to
+*Only select repositories* (just the repos you scan) with three *Read-only* permissions —
+**Metadata**, **Pull requests**, **Issues** — and nothing else. Full setup in the
+[README](./README.md#github-access-token).
+
 ## Run
 
 ```bash