v2.36.1 — clearer GitHub sign-in failures and safe slugs for odd import links

fix:

• Sign-in (GitHub 429). GitHub blocks the token exchange from some Cloudflare Workers egress addresses with HTTP 429. The Worker now retries a few times; if every try is blocked, the popup says so and suggests signing in again. Thanks @adbertram (#187).
• Sign-in (all providers). A failed sign-in popup now stays open so readers can see it, instead of closing after 250 ms. Other providers' 429s are not retried, return 503, and forward their Retry-After. Logs carry status and retry_after on oauth.token.
• Import. A thread link the read API would reject (percent-encoding, characters outside a-z 0-9 _ - . /, over 200 characters) now gets a stable synthetic slug instead of an unreachable page. The import plan counts these as fallback_slugs. Earlier imports may have stranded such pages; AGENTS-OPERATE.md has the SQL to find and move them (#186, #117).

No new env vars, endpoints or migrations.