feat: server-level GitHub machine credential for authenticated requests (#109)

## Why

Anonymous GitHub is capped at 60 requests/hour and cannot read private repositories. A machine credential usable by a free (non-enterprise) account is needed to lift the request budget to ~5000/hr and to read private-repo release assets.

Builds on the background syncer (#108, now merged to `master`); this diff is the auth changes only.

## How

- Add `internal/githubauth`: a process-wide GitHub credential delivered via env/secret, applied by default to every outbound GitHub request (releases scan, ranged asset-header GETs, and the generic-github byte proxy for private assets).
- Support two modes:
  - **PAT** — `GITHUB_TOKEN` sent as `Authorization: Bearer <token>`.
  - **GitHub App** — `GITHUB_APP_ID` + `GITHUB_APP_INSTALLATION_ID` + private key (`GITHUB_APP_PRIVATE_KEY` inline PEM or `GITHUB_APP_PRIVATE_KEY_PATH`). Mint a short-lived RS256 JWT with stdlib `crypto/rsa` (no new dependency), exchange it at `POST /app/installations/{id}/access_tokens` for a ~1h installation token, cache it, and single-flight a refresh a few minutes before expiry.
- Inject at the two GitHub call paths: the rpm github provider header builder (releases + ranged fetches) and the generic provider `AuthHeaders` (byte proxy, github.com hosts only; the pre-signed `objects.githubusercontent.com` redirect deliberately gets no Authorization).
- Honor precedence: a remote's own `username`/`password` overrides the server credential; no credential configured stays anonymous (current behavior).
- Fail closed at startup on partial App configuration (e.g. App id without a private key); a token-and-App conflict is also rejected.
- Never persist the credential to the DB, return it from an API, or log it (token-exchange failures never echo the response body).
- Read config via the existing `getenv` convention; document PAT vs App setup, the free-account fine-grained PAT scopes (Contents:read + Metadata:read), precedence, and the rate-limit implication.

## Rate limit

Authenticated requests share the syncer's single global limiter — no second limiter is added. A token raises the effective GitHub ceiling (~5000/hr vs ~60/hr), so the limiter defaults stay safe.

## Tests

`internal/githubauth` and `internal/provider/{rpm,generic}`:
- PAT attaches the correct `Authorization` header to releases + asset-header requests.
- App mints a valid RS256 JWT (verified against the app public key), exchanges it at a mocked endpoint, reuses the cached token without re-exchanging, refreshes near expiry, and single-flights concurrent callers.
- Per-remote credential overrides the server credential (rpm + generic).
- No credential → no `Authorization` header, requests still succeed anonymously.
- ETag/304 flow still works with auth attached.
- The credential does not appear in a remote's serialized JSON.
- Config validation: no-config is anonymous; partial App config and token/App conflict both error.

Verified fail-before/pass-after for the injection tests. `gofmt -l`, `go build ./...`, `go vet ./...`, `go test ./...` all clean (26 packages).

Reviewed-on: #109
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

internal/provider/rpm/github.go

@@ -20,6 +20,7 @@ import (
 	rpmlib "github.com/cavaliergopher/rpm"
 	"golang.org/x/time/rate"
 
+	"git.unkin.net/unkin/artifactapi/internal/githubauth"
 	"git.unkin.net/unkin/artifactapi/internal/provider"
 	"git.unkin.net/unkin/artifactapi/pkg/models"
 )
@@ -76,6 +77,10 @@ type GitHubProvider struct {
 	// the shared background work queue instead of an inline per-replica scan.
 	syncer *Syncer
 
+	// serverCred overrides the process-wide GitHub credential for this provider
+	// instance. nil falls back to githubauth.Server(); set directly in tests.
+	serverCred githubauth.Credential
+
 	mu       sync.Mutex
 	scanning map[string]bool
 	lastScan map[string]time.Time
@@ -136,8 +141,8 @@ func (p *GitHubProvider) RewriteResponse(_ []byte, _ models.Remote, _ string) ([
 	return nil, nil
 }
 
-func (p *GitHubProvider) AuthHeaders(_ context.Context, remote models.Remote) (http.Header, error) {
-	return githubHeaders(remote, false), nil
+func (p *GitHubProvider) AuthHeaders(ctx context.Context, remote models.Remote) (http.Header, error) {
+	return p.githubHeaders(ctx, remote, false)
 }
 
 // ServeRemote answers a request against a github_rpm remote. It refreshes the
@@ -414,7 +419,11 @@ func (p *GitHubProvider) fetchReleases(ctx context.Context, remote models.Remote
 		if err != nil {
 			return nil, "", false, err
 		}
-		copyHeaders(req, githubHeaders(remote, true))
+		hdr, err := p.githubHeaders(ctx, remote, true)
+		if err != nil {
+			return nil, "", false, err
+		}
+		copyHeaders(req, hdr)
 		if page == 1 && etag != "" {
 			req.Header.Set("If-None-Match", etag)
 		}
@@ -571,7 +580,11 @@ func (p *GitHubProvider) rangeGet(ctx context.Context, remote models.Remote, dow
 	if err != nil {
 		return nil, false, err
 	}
-	copyHeaders(req, githubHeaders(remote, false))
+	hdr, err := p.githubHeaders(ctx, remote, false)
+	if err != nil {
+		return nil, false, err
+	}
+	copyHeaders(req, hdr)
 	req.Header.Set("Range", fmt.Sprintf("bytes=0-%d", n-1))
 
 	if err := p.limiterWait(ctx); err != nil {
@@ -599,7 +612,11 @@ func (p *GitHubProvider) computeSHA256(ctx context.Context, remote models.Remote
 	if err != nil {
 		return "", err
 	}
-	copyHeaders(req, githubHeaders(remote, false))
+	hdr, err := p.githubHeaders(ctx, remote, false)
+	if err != nil {
+		return "", err
+	}
+	copyHeaders(req, hdr)
 
 	if err := p.limiterWait(ctx); err != nil {
 		return "", err
@@ -638,23 +655,48 @@ func sha256FromDigest(digest string) (string, bool) {
 	return "", false
 }
 
-func githubHeaders(remote models.Remote, api bool) http.Header {
+// githubHeaders builds the outbound headers for a GitHub request, attaching a
+// bearer credential when one is available. A per-remote credential wins; absent
+// that, the process-wide server credential is used; absent both, the request is
+// unauthenticated (anonymous, subject to the 60/hr cap).
+func (p *GitHubProvider) githubHeaders(ctx context.Context, remote models.Remote, api bool) (http.Header, error) {
 	h := http.Header{}
 	if api {
 		h.Set("Accept", "application/vnd.github+json")
 		h.Set("X-GitHub-Api-Version", "2022-11-28")
 	}
-	if tok := githubToken(remote); tok != "" {
+	tok, err := p.githubToken(ctx, remote)
+	if err != nil {
+		return nil, err
+	}
+	if tok != "" {
 		h.Set("Authorization", "Bearer "+tok)
 	}
-	return h
+	return h, nil
 }
 
-func githubToken(remote models.Remote) string {
+// githubToken resolves the bearer token for a remote. Precedence: a per-remote
+// credential (password, then username) overrides the server credential.
+func (p *GitHubProvider) githubToken(ctx context.Context, remote models.Remote) (string, error) {
 	if remote.Password != "" {
-		return remote.Password
+		return remote.Password, nil
 	}
-	return remote.Username
+	if remote.Username != "" {
+		return remote.Username, nil
+	}
+	if c := p.serverCredential(); c != nil {
+		return c.Token(ctx)
+	}
+	return "", nil
+}
+
+// serverCredential returns this provider's server credential, defaulting to the
+// process-wide one installed at startup.
+func (p *GitHubProvider) serverCredential() githubauth.Credential {
+	if p.serverCred != nil {
+		return p.serverCred
+	}
+	return githubauth.Server()
 }
 
 func copyHeaders(req *http.Request, h http.Header) {