Replace env-var PAT with GitHub device authorization flow + Keychain0.4.0

Closes #6, #7 (milestone 0.4.0).

- GitHubDeviceAuthClient implements the OAuth 2.0 device authorization
  grant (device code request + poll for token) against GitHub's OAuth
  App endpoints. Verified against the real endpoints directly.
- KeychainTokenStore stores the resulting token in the app's own
  Keychain item (not synced to iCloud Keychain), no shared entitlement
  needed since nothing else reads it.
- AuthStore drives the sign-in state machine (signedOut /
  awaitingAuthorization / signedIn) and a new SignInView replaces the
  old "missing token" error state with an actual sign-in UI.
- SecurityEventStore now reads the token from Keychain instead of the
  GITHUB_TOKEN environment variable, which is fully retired.
- Scope requested is security_events, the narrowest available for
  classic OAuth Apps (no read-only variant exists at this level, unlike
  fine-grained PATs). Private-repo Dependabot alerts may need broader
  repo scope — to be confirmed with real-world testing.

1 files changed, 86 insertions, 0 deletions

diff --git a/octosentry/SignInView.swift b/octosentry/SignInView.swift
new file mode 100644
index 0000000..6d791df
--- /dev/null
+++ b/octosentry/SignInView.swift
@@ -0,0 +1,86 @@
+//
+//  SignInView.swift
+//  octosentry
+//
+
+import AppKit
+import SwiftUI
+
+struct SignInView: View {
+    var authStore: AuthStore
+
+    var body: some View {
+        VStack(spacing: 16) {
+            Spacer()
+
+            switch authStore.state {
+            case .signedOut:
+                signedOutContent
+            case .awaitingAuthorization(let userCode, let verificationURL):
+                awaitingAuthorizationContent(userCode: userCode, verificationURL: verificationURL)
+            case .signedIn:
+                EmptyView()
+            }
+
+            if let errorMessage = authStore.errorMessage {
+                Text(errorMessage)
+                    .font(.caption)
+                    .foregroundStyle(.red)
+                    .multilineTextAlignment(.center)
+                    .padding(.horizontal)
+            }
+
+            Spacer()
+        }
+        .frame(maxWidth: .infinity, maxHeight: .infinity)
+        .padding()
+    }
+
+    private var signedOutContent: some View {
+        VStack(spacing: 16) {
+            Image(systemName: "shield.lefthalf.filled")
+                .font(.system(size: 40))
+                .foregroundStyle(.secondary)
+            Text("Sign in with GitHub to see your security alerts.")
+                .font(.callout)
+                .multilineTextAlignment(.center)
+                .foregroundStyle(.secondary)
+                .padding(.horizontal)
+            Button("Sign in with GitHub") {
+                authStore.signIn()
+            }
+            .buttonStyle(.borderedProminent)
+        }
+    }
+
+    private func awaitingAuthorizationContent(userCode: String, verificationURL: URL) -> some View {
+        VStack(spacing: 12) {
+            Text("Enter this code on GitHub")
+                .font(.callout)
+                .foregroundStyle(.secondary)
+
+            Text(userCode)
+                .font(.system(.title, design: .monospaced).weight(.bold))
+                .textSelection(.enabled)
+
+            HStack(spacing: 8) {
+                Button("Copy Code") {
+                    NSPasteboard.general.clearContents()
+                    NSPasteboard.general.setString(userCode, forType: .string)
+                }
+                Button("Open GitHub") {
+                    NSWorkspace.shared.open(verificationURL)
+                }
+                .buttonStyle(.borderedProminent)
+            }
+
+            ProgressView()
+                .controlSize(.small)
+                .padding(.top, 4)
+        }
+    }
+}
+
+#Preview {
+    SignInView(authStore: AuthStore())
+}