fix(github): gate multiple organization installations

[RSO]

Summary

• allow multiple GitHub App installations only for organizations configured per environment
• read GITHUB_MULTIPLE_INSTALLATION_ORGANIZATION_IDS as a validated comma-separated UUID allowlist
• hide and reject additional installation attempts for other organizations
• enforce the gate in the UI capability response, install-state minting, and owner-aware database upsert
• return a dedicated callback error with non-retryable user guidance

Environment configuration

Configure each deployment environment with GITHUB_MULTIPLE_INSTALLATION_ORGANIZATION_IDS. Unset or empty disables multiple installations for all organizations.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (11 files)

• ENVIRONMENT.md
• apps/web/src/app/api/integrations/github/callback/route.test.ts
• apps/web/src/app/api/integrations/github/callback/route.ts
• apps/web/src/components/integrations/GitHubIntegrationDetails.test.ts
• apps/web/src/components/integrations/GitHubIntegrationDetails.tsx
• apps/web/src/lib/integrations/db/platform-integrations.test.ts
• apps/web/src/lib/integrations/db/platform-integrations.ts
• apps/web/src/lib/integrations/github/multiple-installations.test.ts
• apps/web/src/lib/integrations/github/multiple-installations.ts
• apps/web/src/routers/github-apps-router.test.ts
• apps/web/src/routers/github-apps-router.ts

---

_{Reviewed by grok-4.6 · Input: 141.2K · Output: 25.9K · Cached: 1.8M}

_{Review guidance: REVIEW.md from base branch main}