feat(github): show granted OAuth scopes and warn when repo is missing

[Goodyslim]

Closes #57

What

The GitHub dashboard showed the scopes requested at connect time, not the scopes GitHub actually granted. This shows the granted scopes and warns when repo is absent.

Changes

• app/services/github.py - new GitHubClient.get_granted_scopes() reads the X-OAuth-Scopes response header from GET /user (the token's current grants).
• app/github/routes.py
  • index() renders the granted scopes (live read preferred, connect-time value as fallback) and a repo_scope_missing flag.
  • callback() prefers the header-reported scopes when storing the account.
  • /github/api/status now includes repo_scope_missing.
• app/templates/github/index.html - displays granted scopes: ... and shows a role="alert" warning banner with a Reconnect link when repo is missing.

Scopes are informational only; authorization always depends on the token, not on this list (documented on the new method and helper).

Acceptance criteria

• Granted scopes are fetched from GET /user (and the token-exchange response as a fallback).
• A warning banner appears when the repo scope is absent.
• Scopes are never treated as a source of truth for authorization decisions.

Validation

• pytest tests/test_github_service.py tests/test_github_routes.py -> all pass (adds tests for header parsing, the warning banner, the stored-scopes fallback, and the status flag).
• ruff check and black --check clean on the changed files.