Closes #355

Summary

Fixes a cross-flow GitHub OAuth token lifecycle issue where normal GitHub login could silently overwrite an existing follow-capable GitHub integration token with a reduced-scope login token.

Previously:

• the GitHub connect/follow flow stored tokens with follow-capable scopes such as user:follow
• a later GitHub login flow performed an unconditional oAuthToken.upsert
• the lower-scope login token overwrote the existing integration token
• GitHub follow functionality silently broke afterward

This PR preserves higher-privilege follow-capable tokens during subsequent GitHub login flows while keeping the existing login behavior intact.

Root Cause

connect.ts stores GitHub integration tokens in oAuthToken with follow-capable scopes.

Later, auth.ts performed an unconditional:

oAuthToken.upsert(...)

using the GitHub login token (read:user user:email).

Because both flows shared the same persisted GitHub credential record:

• the existing integration token was overwritten
• user:follow capability was lost
• follow automation silently failed afterward

The issue was difficult to detect because:

• login flow worked independently
• connect flow worked independently
• follow flow worked independently with valid scopes
• but cross-flow token persistence invariants were not preserved

Fix Strategy

Before replacing an existing GitHub token during login, the backend now:

1. checks existing stored GitHub scopes
2. detects whether the existing token contains user:follow
3. compares incoming login token scopes
4. preserves the existing higher-privilege token when the new token has reduced scopes

Behavior after fix:

• existing follow-capable tokens are preserved
• normal GitHub login still succeeds
• JWT issuance/login flow remains unchanged
• legitimate token upgrades are still allowed
• new users without stored tokens still persist normally

Files Changed

• apps/backend/src/routes/auth.ts
• apps/backend/src/__tests__/auth.github-token.test.ts

Tests

Added focused regression coverage for:

• preserving an existing follow-capable token
• subsequent reduced-scope GitHub login
• normal login flow still succeeding
• legitimate token upgrades
• preserving follow integration state consistency

Verification

..\..\node_modules\.bin\vitest.CMD run src\__tests__\auth.github-token.test.ts src\__tests__\connect.test.ts src\__tests__\follow.test.ts

Result:

Test Files  3 passed (3)
Tests       6 passed (6)

Notes

This PR intentionally keeps scope minimal and focused on GitHub OAuth token scope preservation.

No OAuth architecture rewrite, schema redesign, provider refactor, or unrelated auth cleanup was introduced.