fix(github): migrate production OAuth to the organization BFF

[Redchar1992]

Summary

• migrate the current online GitHub OAuth flow to an organization-owned Deno BFF
• keep OAuth state, PKCE, the GitHub access token, and token encryption in Deno KV
• return only an opaque, origin-bound TronIDE session to the browser
• route GitHub REST, Gist, and Git smart-HTTP operations through allow-listed BFF endpoints
• always request GitHub account selection with prompt=select_account
• remove the personal Deno endpoint/client configuration and fail closed when the organization BFF is not configured

Required before merge / production cutover

1. Create the tronweb3 GitHub OAuth App and Deno project from the agreed setup documents.
2. Deploy services/github-oauth/main.ts with Deno KV and these environment variables:
   • GITHUB_CLIENT_ID
   • GITHUB_CLIENT_SECRET
   • SESSION_ENCRYPTION_KEY
   • REDIRECT_URI
   • ALLOWED_ORIGINS=https://test.tronide.allsandlab.com,https://tronide.io
3. Set the GitHub repository variable TRONIDE_GITHUB_BFF_ORIGIN to the organization-owned Deno origin. The Pages workflow intentionally fails before build if it is missing or is not HTTPS.
4. Verify the OAuth App callback exactly matches <TRONIDE_GITHUB_BFF_ORIGIN>/callback.
5. Deploy and verify the BFF before merging/deploying the frontend.

The PR author account can open this PR but cannot read or set tronweb3/TronIDE repository variables (GitHub returns 403), so an organization maintainer must complete step 3.

Validation

• pnpm dlx deno@2.4.2 task check
• pnpm dlx deno@2.4.2 task test — 9 passed
• frontend OAuth/security regression tests — 64 passed
• Gist BFF tests — 21 passed
• targeted ESLint + compiler/entry consistency checks
• Playwright GitHub session/menu/PAT-removal flows — 6 passed
• Playwright Git smart-HTTP session-header/force-push gate — 1 passed
• production build with an organization BFF origin — passed
• production artifact contains the configured BFF origin and no personal Deno endpoint, legacy OAuth client ID, or source maps

Known baseline limitation

apps/remix-ide/test/remix-220-home-parity-test.js reaches and passes the changed OAuth assertions, then fails on a traceability Markdown file that is already referenced but absent on main. This PR does not introduce that unrelated baseline issue.

A live OAuth authorization cannot be completed until the organization OAuth App and Deno environment are available; perform the test/production account, Gist, private repository, push/pull, disconnect, and expiry checks during cutover.

CI status after opening the PR

• GitHub OAuth BFF checks: passed
• Build: passed
• Playwright smoke: skipped by the existing pull-request trigger policy
• Lint: stopped in pnpm audit --prod because the current main dependency graph contains 7 newly reported advisories (brace-expansion, mermaid, and dompurify). This PR changes no package manifest or lockfile, and the targeted ESLint checks for all changed frontend files pass locally.

The existing Pages workflow runs only after a push to main (or a manual dispatch), so this pull request does not deploy the online site before merge.

[Redchar1992]

Closing this PR because the OAuth BFF changes will be reapplied on release/v2.3.3 and included in the v2.3.3 test submission.