[P2.6] Fix GitHub integration defects: cache-key ambiguity, search qualifier injection, misreported 403

[frankbria]

Filed by the SaaS launch review. Priority P2.6 — severity medium, category correctness.

Problem

The issue cache key is f"{repo}|{page}|{per_page}|{search}|{label}|{user_id}", so a '|' inside search text collides with the label field and serves one search's results for a different filter — wrong data, no error. The user's search string is joined verbatim into the GitHub search query alongside repo:/is: qualifiers, so a search containing repo:other/thing reaches repositories outside the connected one — in a hosted deployment the operator's PAT becomes enumerable through a text field. And a search-API 403 (secondary rate limit) is reported as 'missing issues:read scope', sending users to regenerate a PAT that was never the problem.

Evidence

• codeframe/ui/routers/github_integrations_v2.py:384
• codeframe/core/github_issues_service.py:422
• codeframe/core/github_issues_service.py:95

Acceptance criteria

• Cache key is unambiguous (JSON-encoded tuple or hash); a test with '|' in the search term proves two queries do not collide
• Search text cannot introduce qualifiers; test asserts a repo:other/x search still scopes to the connected repo
• A 403 from the search API is distinguished from a scope error by response body/headers, with different message text

Dependencies

• blocked by [P1.22] Paginate GitHub PR/check/review calls and bound the issue-import fan-out #940 (P1.22)

---

Atomic by construction: one developer, one focused session.