Replace PAT auth with GitHub App for production servers

[jonathonbyrdziak]

Summary

• Replaces fine-grained PAT flow with GitHub App manifest flow for production/staging server authentication
• App belongs to the org (not a person) — access survives team member departures
• CLI generates a pre-configured manifest URL with all permissions baked in — user just clicks and creates
• New GitHubApp helper handles JWT signing, installation token generation, and credential refresh

Flow

1. protocol init → production → enter private repo URL → access fails
2. CLI generates manifest URL: https://github.com/organizations/{org}/settings/apps/new?manifest=...
3. User clicks → app is pre-configured (Contents: read, Variables: read, Metadata: read)
4. User generates private key, installs app on repo
5. Pastes App ID + private key path back into CLI
6. CLI verifies: JWT → installation lookup → token generation → repo access test
7. Credentials stored in ~/.protocol/.node/ (github-app.json + github-app.pem, 0600)

Files

• New: src/Helpers/GitHubApp.php — JWT, installation tokens, credential management
• Modified: src/Commands/ProtocolInit.php — flowGitAuth uses GitHub App instead of PAT

Test plan

• Run protocol init → production → private repo URL the server can't access
• Verify manifest URL loads GitHub App creation form with correct permissions
• Create app, generate private key, install on repo
• Paste App ID + key path — verify JWT, installation lookup, and access test succeed
• Confirm credentials stored at ~/.protocol/.node/github-app.json and .pem
• Re-run init with existing credentials — verify it refreshes without re-prompting

🤖 Generated with Claude Code