v2.0.0 — Self-hosted OAuth proxy

Breaking: replaces the hardcoded cors-anywhere proxy with a self-hosted OAuth proxy (worker/). github-oauth-options now requires a proxy URL; adds owner/repo/label options. Client secret stays server-side.