## Summary - add optional, case-insensitive `GITHUB_ALLOWED_USERS` and `GITHUB_ALLOWED_ORGANIZATIONS` lists with union semantics - enforce admission across OAuth, browser session rechecks, sockets, agent permissions, and hosted MCP with cached GitHub organization membership checks - document GitHub App Members read access, MCP token requirements, deployment configuration, and revocation behavior

## Configuration ```dotenv GITHUB_ALLOWED_USERS=octocat,hubot GITHUB_ALLOWED_ORGANIZATIONS=githubnext ```

Leaving both variables empty preserves the existing unrestricted behavior. Organization admission requires the GitHub App to have Members: Read-only permission and an approved installation on each allowed organization.

## Testing - `bun test` (817 passed, 2 skipped) - `bun run types` - `bun run ci` - `docker compose config --quiet` - `bun run e2e` (159 passed) - targeted organization-admission E2E after final fixes (1 passed)