Fix/ connection duplication, github sso login and some more

[jplorier]

Summary

Trying to use the app I found multiple issues I'm addressing from my fork.

Changes

Testing

• Tests pass (pnpm turbo test)
• Typechecks pass (pnpm turbo typecheck)

Related

Closes #

Screenshots

[jonwiggins]

Thanks for taking the time to use Optio in anger and send fixes back — that's genuinely appreciated, and skimming the diff there does look to be real value in here (the connection duplication handling and the SSO login path in particular).

That said, we can't review this as-is: it touches 11 files across five separate areas (DB schema, auth plugin, connection/secret/task-config/task/workflow services, web setup + OAuth callback, and the helm chart) and the PR description template is empty, so we have no way to tell which change fixes which problem, what the observed bugs were, or how any of it was tested.

Could you:

1. Fill in the PR template — for each fix: what the symptom was, what the root cause was, and how you verified the fix (the "Testing" checklist is unchecked too — pnpm turbo test / pnpm turbo typecheck results would help).
2. Ideally, split this into one PR per fix (e.g. "fix: connection duplication", "fix: GitHub SSO login", ...). Small scoped PRs with a clear description we can usually review and merge same-day; a multi-area grab-bag we can't.

Note the schema.ts change will also need a Drizzle migration (npx drizzle-kit generate — new migrations use unix-timestamp prefixes), which is another reason to keep that one isolated.

Looking forward to the split-up versions — thanks again for contributing.

[jonwiggins]

Closing: this bundles several unrelated changes from a main-branch head, and two are blockers — the hasAnyUser() gate fails open (a transient DB error re-opens unauthenticated access to POST /api/secrets and /api/repos on a fully set-up instance), and the nullsNotDistinct schema change ships without a migration. The genuinely live bug it found (seedBuiltInProviders duplicating built-in providers on every restart because ON CONFLICT never fires on NULL workspace_id) was real and has been fixed on main with a dedup migration + partial unique index. Thanks for finding it!