fix(web): enforce GitHub installation admin proof

[RSO]

Summary

• require a GitHub OAuth authorization code for installation and update callbacks
• verify the OAuth-authorized GitHub user administers the supplied installation before app-authenticated lookup or persistence
• fail closed with not_installation_admin when the code is missing, the user is not an administrator, or OAuth/GitHub verification fails
• preserve existing app-initiated and organization-aware error redirects

Security impact

Previously, administrator proof ran in report-only mode. A callback could continue using GitHub App credentials and bind an installation even when no OAuth code was present, the authenticated GitHub user did not administer the installation, or verification failed. Rejected callbacks now stop before app authentication, installation lookup, repository access, and database persistence.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/app/api/integrations/github/callback/route.ts
• apps/web/src/app/api/integrations/github/callback/route.test.ts

---

_{Reviewed by grok-4.6 · Input: 130.4K · Output: 10.9K · Cached: 307.6K}

_{Review guidance: REVIEW.md from base branch main}