Replace env-var PAT with GitHub device authorization flow + Keychain0.4.0

Closes #6, #7 (milestone 0.4.0).

- GitHubDeviceAuthClient implements the OAuth 2.0 device authorization
  grant (device code request + poll for token) against GitHub's OAuth
  App endpoints. Verified against the real endpoints directly.
- KeychainTokenStore stores the resulting token in the app's own
  Keychain item (not synced to iCloud Keychain), no shared entitlement
  needed since nothing else reads it.
- AuthStore drives the sign-in state machine (signedOut /
  awaitingAuthorization / signedIn) and a new SignInView replaces the
  old "missing token" error state with an actual sign-in UI.
- SecurityEventStore now reads the token from Keychain instead of the
  GITHUB_TOKEN environment variable, which is fully retired.
- Scope requested is security_events, the narrowest available for
  classic OAuth Apps (no read-only variant exists at this level, unlike
  fine-grained PATs). Private-repo Dependabot alerts may need broader
  repo scope — to be confirmed with real-world testing.

1 files changed, 4 insertions, 4 deletions

diff --git a/octosentry/SecurityEventStore.swift b/octosentry/SecurityEventStore.swift
index 11f813c..65a7280 100644
--- a/octosentry/SecurityEventStore.swift
+++ b/octosentry/SecurityEventStore.swift
@@ -3,8 +3,8 @@
 //  octosentry
 //
 //  Holds the fetched event stream for the popover. Watch list, seen-state,
-//  and last-fetch timestamps are persisted (see PersistedState); the PAT
-//  is still read from GITHUB_TOKEN as a dev-only shortcut (spec §13).
+//  and last-fetch timestamps are persisted (see PersistedState); the token
+//  comes from Keychain, put there by the device authorization flow (spec §6).
 //
 //  Each alert source is fetched independently, per repo, so a problem
 //  with one endpoint (or one repo) doesn't blank out the rest. A 403/404
@@ -42,8 +42,8 @@ final class SecurityEventStore {
         minimumSeverity = state.minimumSeverity
         watchedRepos = state.watchedRepos
 
-        guard let token = ProcessInfo.processInfo.environment["GITHUB_TOKEN"], !token.isEmpty else {
-            errorMessages = [GitHubAPIError.missingToken.errorDescription ?? "Missing GITHUB_TOKEN."]
+        guard let token = KeychainTokenStore.load() else {
+            errorMessages = [GitHubAPIError.missingToken.errorDescription ?? "Not signed in."]
             return
         }