Replace env-var PAT with GitHub device authorization flow + Keychain0.4.0

Closes #6, #7 (milestone 0.4.0).

- GitHubDeviceAuthClient implements the OAuth 2.0 device authorization
  grant (device code request + poll for token) against GitHub's OAuth
  App endpoints. Verified against the real endpoints directly.
- KeychainTokenStore stores the resulting token in the app's own
  Keychain item (not synced to iCloud Keychain), no shared entitlement
  needed since nothing else reads it.
- AuthStore drives the sign-in state machine (signedOut /
  awaitingAuthorization / signedIn) and a new SignInView replaces the
  old "missing token" error state with an actual sign-in UI.
- SecurityEventStore now reads the token from Keychain instead of the
  GITHUB_TOKEN environment variable, which is fully retired.
- Scope requested is security_events, the narrowest available for
  classic OAuth Apps (no read-only variant exists at this level, unlike
  fine-grained PATs). Private-repo Dependabot alerts may need broader
  repo scope — to be confirmed with real-world testing.

1 files changed, 2 insertions, 1 deletions

diff --git a/octosentry/octosentryApp.swift b/octosentry/octosentryApp.swift
index 4d5a859..cf7522d 100644
--- a/octosentry/octosentryApp.swift
+++ b/octosentry/octosentryApp.swift
@@ -10,10 +10,11 @@ import SwiftUI
 @main
 struct octosentryApp: App {
     @State private var store = SecurityEventStore()
+    @State private var authStore = AuthStore()
 
     var body: some Scene {
         MenuBarExtra("OctoSentry", systemImage: "shield.lefthalf.filled") {
-            SecurityEventListView(store: store)
+            SecurityEventListView(store: store, authStore: authStore)
         }
         .menuBarExtraStyle(.window)
     }