Add GitHub token auth for production server init

[jonathonbyrdziak]

Summary

• When protocol init detects a production/staging server can't access the provided repo URL, it now guides the user through creating an organization-level fine-grained PAT with read-only permissions
• Token is stored securely in ~/.protocol/.node/github-token (0600) and configured via git credential helper
• Removes the redundant environment question from slave node flow (already chosen in step 1)

Why org-level tokens?

If a developer who set up the server leaves the org and their personal token is revoked, production breaks. Org-level tokens belong to the organization, not an individual — SOC2 compliant with minimal permissions (Contents: Read, Metadata: Read).

Flow

1. User provides repo URL → git ls-remote tests access
2. If access fails on a GitHub repo → walks through fine-grained PAT creation steps
3. User pastes token → verifies it works → stores in .node/ with git credential helper
4. For non-GitHub repos, falls back to recommending protocol key:generate for SSH

Test plan

• Run protocol init → choose production → enter a private repo URL the server can't access
• Verify the auth guidance appears with correct org/repo names
• Paste a valid fine-grained PAT and confirm access verification succeeds
• Verify token stored at ~/.protocol/.node/github-token with 0600 permissions
• Verify git credential helper configured and subsequent git operations work
• Test with a repo the server already has access to — should skip auth flow entirely

🤖 Generated with Claude Code