feat(auth): restrict GitHub login by organization

[adrian-lorenzo]

What changes

• Add optional GITHUB_OAUTH_ALLOWED_ORGANIZATION configuration for direct GitHub authentication.
• Require GitHub to report an active membership before Facility resolves or persists the login; non-members and pending members receive organization_membership_required.
• Preserve existing invitation and App-installation checks, with no membership API call when the variable is blank or unset.
• Wire the setting through Docker Compose and the AWS Terraform module, and document the required GitHub App Members read permission.

Why

Self-hosted teams need to limit Facility login to one GitHub organization without reintroducing the WorkOS/OIDC broker. This keeps the current direct GitHub flow and makes the additional organization gate explicitly opt-in.

Verification

• Focused provider/config tests: 17 passed, covering normalization, unset behavior, active membership, pending/non-member denial, malformed responses, and upstream failure.

• Database-backed browser auth integration: 4 passed, including active-member success, non-member denial with no session, and unrestricted login when unset.

• terraform -chdir=infra/terraform/aws validate reports the AWS configuration is valid.

• Rendered Docker Compose with GITHUB_OAUTH_ALLOWED_ORGANIZATION=theam and confirmed the API container receives that exact value.

• Checked the implementation against the official GitHub endpoint contract for GET /user/memberships/orgs/{org} and its Members (read) permission.

• pnpm verify passes locally

• Behaviour verified beyond the test suite (Terraform validation and rendered Docker Compose configuration)

• Documentation updated, or no user-facing change