## Summary

- replace the broad OAuth App grant with per-deployment GitHub App user authorization and installation-aware repository access - keep browser cookie verifiers, GitHub access tokens, refresh tokens, and credential revisions exclusively in process memory - define `web_sessions` in the initial schema as a token-free ownership registry containing only session/user identifiers and timestamps - sign users out and reset Planner ownership on restart while preserving plans, transcripts, summaries, and installation state - retain in-process token refresh with singleflight, revision fencing, logout-race protection, and safe Planner/MCP/repository-tool restarts - fence the startup session purge with the database writer lease - add installation/configuration UX and automatic HTTP/WebSocket reauthorization after restart

## Testing

- `bun run ci` - `bun run types` - `bun test` (675 passed, 2 skipped) - PostgreSQL storage suite against a fresh database (12 passed) - `bun run e2e` (81 passed) - `docker build --tag chopin:github-app-test .` - fresh production-container startup against an empty PostgreSQL database - verified the sole applied migration is `001_initial` and live `web_sessions` columns are only `id`, `user_id`, `expires_at`, and `created_at`

## Validation note

Live Copilot and hosted GitHub MCP acceptance of a real `ghu_` token still requires a deployment-owned GitHub App and an entitled user; no production credentials were available in CI or this workspace.