fix(web): remove legacy GitHub install state

[RSO]

Summary

• remove the GITHUB_LEGACY_INSTALL_STATE feature flag and plaintext user_<UUID> / org_<UUID> callback handling
• require GitHub installation callbacks to use database-backed, single-use install state or a valid signed bot-link state
• remove legacy owner and return-path parsing from callback state
• permanently test that plaintext owner-prefixed states are rejected before OAuth, GitHub App authentication, or persistence

Security context

Follow-up to #5477. The production flag is already disabled; this removes the dormant compatibility path so an omitted or changed environment variable cannot re-enable plaintext install state.

Verification

• pnpm --filter web test -- --runInBand src/app/api/integrations/github/callback/route.test.ts src/lib/integrations/validate-return-path.test.ts (52 passed)
• pnpm --filter web typecheck
• pnpm -w exec oxlint --config .oxlintrc.json apps/web/src/app/api/integrations/github/callback/route.ts apps/web/src/app/api/integrations/github/callback/route.test.ts apps/web/src/lib/integrations/validate-return-path.ts apps/web/src/lib/integrations/validate-return-path.test.ts
• git diff --check origin/main...HEAD

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Legacy plaintext GitHub install-state handling and the GITHUB_LEGACY_INSTALL_STATE flag are fully removed; callbacks now require a consumed DB token or a valid bot-link state, with tests covering rejection before OAuth or persistence.

Files Reviewed (4 files)

• apps/web/src/app/api/integrations/github/callback/route.ts
• apps/web/src/app/api/integrations/github/callback/route.test.ts
• apps/web/src/lib/integrations/validate-return-path.ts
• apps/web/src/lib/integrations/validate-return-path.test.ts

---

_{Reviewed by grok-4.6 · Input: 135.8K · Output: 7.9K · Cached: 309.4K}

_{Review guidance: REVIEW.md from base branch main}