Replace env-var PAT with GitHub device authorization flow + Keychain0.4.0

Closes #6, #7 (milestone 0.4.0).

- GitHubDeviceAuthClient implements the OAuth 2.0 device authorization
  grant (device code request + poll for token) against GitHub's OAuth
  App endpoints. Verified against the real endpoints directly.
- KeychainTokenStore stores the resulting token in the app's own
  Keychain item (not synced to iCloud Keychain), no shared entitlement
  needed since nothing else reads it.
- AuthStore drives the sign-in state machine (signedOut /
  awaitingAuthorization / signedIn) and a new SignInView replaces the
  old "missing token" error state with an actual sign-in UI.
- SecurityEventStore now reads the token from Keychain instead of the
  GITHUB_TOKEN environment variable, which is fully retired.
- Scope requested is security_events, the narrowest available for
  classic OAuth Apps (no read-only variant exists at this level, unlike
  fine-grained PATs). Private-repo Dependabot alerts may need broader
  repo scope — to be confirmed with real-world testing.

1 files changed, 14 insertions, 15 deletions

diff --git a/README.md b/README.md
index 2415317..2b9497e 100644
--- a/README.md
+++ b/README.md
@@ -14,33 +14,32 @@ just a fast triage view that deep-links out to github.com to act.
 - Click an alert to open it directly on github.com
 - Errors and unavailable sources (e.g. an alert type disabled for a repo)
   are surfaced in the popover instead of failing silently
+- Add or remove watched repos from the popover; a background poll keeps
+  the feed fresh even while it's closed
+- Sign in with GitHub via device authorization — no password or manually
+  generated token needed, and nothing is ever typed into the app itself
 - Zero third-party dependencies — pure SwiftUI and URLSession
 
 ## Requirements
 
 - macOS 14 or later
-- A GitHub personal access token (fine-grained or classic) with read
-  access to Dependabot alerts, code scanning alerts, and secret scanning
-  alerts for the repo you want to watch
+- A GitHub account with access to whatever repos you want to watch
 
 ## Usage
 
-octosentry currently watches a single, hardcoded repo and reads its
-GitHub token from the `GITHUB_TOKEN` environment variable — this is a
-development-only shortcut ahead of a proper device authorization flow.
-
 1. Build and run the app (see Building, below).
-2. Set `GITHUB_TOKEN` in your **personal, non-shared** Xcode scheme
-   (Product → Scheme → Edit Scheme… → Run → Arguments →
-   Environment Variables). Don't add it to a shared scheme — that would
-   commit the token to git.
-3. Click the shield icon in the menu bar to open the popover. It fetches
-   automatically on open, or use the refresh button.
+2. Click the shield icon in the menu bar, then **Sign in with GitHub**.
+   You'll get a short code — click **Open GitHub**, enter the code there,
+   and authorize. The popover updates automatically once that completes.
+3. Click the gear icon to add or remove watched repos (`owner/repo`).
 4. Click any alert to open it on github.com.
 
 If a source shows as unavailable, it usually means that alert type is
-disabled for the repo, or the token is missing that one permission — not
-that something is broken.
+disabled for the repo, or your account lacks permission for it — not
+that something is broken. Classic OAuth's `security_events` scope
+(what device flow grants) may not be sufficient for Dependabot alerts on
+private repos — if you hit that, it needs verifying against a real
+private repo case by case.
 
 ## Building