feat(auth): add Personal Access Token authentication

[kkiermasz]

Summary

• Add PAT authentication as alternative to OAuth for users in SAML SSO organizations
• PATs can be explicitly authorized for SSO in GitHub settings, solving visibility issues for organization-owned repositories
• Adds auth method picker (OAuth / Personal Access Token) in Account settings
• Stores PAT securely in macOS Keychain alongside OAuth tokens

Changes

• UserSettings.swift: Add AuthMethod enum and authMethod property
• TokenStore.swift: Add savePAT(), loadPAT(), clearPAT() methods
• PATAuthenticator.swift: New file for PAT validation via GET /user
• AppState.swift: Add patAuth property and update token provider
• AppState+Auth.swift: Add loginWithPAT() and logoutCurrentMethod()
• AppState+Refresh.swift: Check both OAuth tokens and PAT before logging out
• AccountSettingsView.swift: Add auth method picker and PAT input UI

🤖 Generated with Claude Code

[steipete]

• Medium: authMethod isn’t persisted; after restart it resets to .oauth, so Logout won’t clear PAT and user can’t truly log out. Persist after PAT login + set on init based on stored PAT. Sources/RepoBar/App/AppState+Auth.swift:20, Sources/RepoBar/App/ AppState.swift:35
• Medium: logoutCurrentMethod relies solely on settings.authMethod; if stale, PAT remains in Keychain. Either derive from actual stored creds or clear both. Sources/RepoBar/App/ AppState+Auth.swift:33
• Medium: PAT keychain save/load bypasses the new access‑group fallback path; can fail when keychain groups are missing. Reuse the shared save/load helpers. Sources/ RepoBarCore/Auth/TokenStore.swift:127

[steipete]

Thanks Jakub, will take over from here.

[steipete]

Landed via temp rebase onto main.\n\n- Gate: pnpm lint && pnpm build && pnpm test\n- Land commit: 82a1212\n- Merge commit: bab0838\n\nThanks @kkiermasz!