feat: wire GitHub PR oracle into milestone verification pipeline

[observerr411]

• Add server/src/services/github-oracle.service.ts: a testable port of
  the script with an injectable fetch. It validates that a PR is merged,
  authored by the learner's linked GitHub account, and merged within the
  milestone window, returning a structured result plus a SHA-256 evidence
  hash for audit.
• Extract the shared rules into scripts/oracle/github-evidence-core.mjs so
  the standalone CLI and the server run identical logic; the CLI now also
  accepts --login / --window-start / --window-end.
• Persist results on milestone_reports (migration 022: oracle_verified,
  oracle_evidence_hash, oracle_checked_at, oracle_detail) via
  milestoneStore.setOracleResult.
• Run the oracle on submission (non-blocking) and re-run it on admin
  approval, gating the on-chain release: a failed/unavailable check
  returns 422 with reasons unless overrideOracle=true.
• Expose POST /api/admin/milestones/:id/verify-oracle for on-demand checks.
• Add jest tests with a mocked GitHub API so it runs in CI without live
  network calls.
• Document the flow in the README and add GITHUB_TOKEN to .env.example.

closes #999