feat(auth): add GitHub authentication

[axelav]

Summary

• replace routine invite-code login with GitHub OAuth while preserving existing accounts
• add closed/public signup, one-time legacy linking, invitations, and four-hour recovery links
• version sessions for immediate revocation and harden OAuth, token, configuration, and logging behavior
• upgrade to Rust 1.94 and SQLx 0.9 for SQLite non-transaction migrations
• document deployment, production readiness, smoke testing, and rollback

Testing

• cargo fmt --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test (200 passed)
• cargo build --release
• git diff --check

Production prerequisites

• register the production GitHub OAuth app
• configure honkytonk-infra secrets and environment
• repair and verify the ongoing database backup job
• verify proxy and upstream query-string logging behavior
• take and restore-test a production SQLite backup
• run the real-provider browser smoke test in closed mode

See docs/github-auth-production-rollout.md for the gated rollout procedure.