Replace env-var PAT with GitHub device authorization flow + Keychain0.4.0

Closes #6, #7 (milestone 0.4.0).

- GitHubDeviceAuthClient implements the OAuth 2.0 device authorization
  grant (device code request + poll for token) against GitHub's OAuth
  App endpoints. Verified against the real endpoints directly.
- KeychainTokenStore stores the resulting token in the app's own
  Keychain item (not synced to iCloud Keychain), no shared entitlement
  needed since nothing else reads it.
- AuthStore drives the sign-in state machine (signedOut /
  awaitingAuthorization / signedIn) and a new SignInView replaces the
  old "missing token" error state with an actual sign-in UI.
- SecurityEventStore now reads the token from Keychain instead of the
  GITHUB_TOKEN environment variable, which is fully retired.
- Scope requested is security_events, the narrowest available for
  classic OAuth Apps (no read-only variant exists at this level, unlike
  fine-grained PATs). Private-repo Dependabot alerts may need broader
  repo scope — to be confirmed with real-world testing.

1 files changed, 38 insertions, 0 deletions

diff --git a/octosentry/DeviceAuthModels.swift b/octosentry/DeviceAuthModels.swift
new file mode 100644
index 0000000..dcd62c6
--- /dev/null
+++ b/octosentry/DeviceAuthModels.swift
@@ -0,0 +1,38 @@
+//
+//  DeviceAuthModels.swift
+//  octosentry
+//
+//  Wire types for GitHub's OAuth 2.0 Device Authorization Grant
+//  (RFC 8628): github.com/login/device/code and
+//  github.com/login/oauth/access_token.
+//
+
+import Foundation
+
+nonisolated struct DeviceCodeResponse: Decodable {
+    let deviceCode: String
+    let userCode: String
+    let verificationUri: URL
+    let expiresIn: Int
+    let interval: Int
+
+    enum CodingKeys: String, CodingKey {
+        case deviceCode = "device_code"
+        case userCode = "user_code"
+        case verificationUri = "verification_uri"
+        case expiresIn = "expires_in"
+        case interval
+    }
+}
+
+nonisolated struct AccessTokenResponse: Decodable {
+    let accessToken: String?
+    let error: String?
+    let interval: Int?
+
+    enum CodingKeys: String, CodingKey {
+        case accessToken = "access_token"
+        case error
+        case interval
+    }
+}