repos: backend — schema, /api/repos routes + GitHub sync provider

Migration 0034: two tables. repo_connections carries the workspace's
per-provider config (owner, base_url, label, last_synced_at,
last_sync_error) and points at an app_connections row for the PAT.
repos is the per-connection cache with (connection_id, external_id)
unique so upsert is idempotent across re-syncs. Cascading deletes clean
up cleanly on connection removal.

cm-secrets grows a FetchAuthorized op — GET with the stored PAT injected
as bearer, returns status + JSON body without ever exposing the
credential to cm-api. This is the least-privilege door for read-only
provider APIs (list repos), distinct from the InvokeHttp path that still
requires a single-use approval grant for outbound writes.

cm-api::routes::repos wires:
- POST /api/repos/connections (broker store_secret + insert both rows +
  initial sync + mark_synced)
- GET /api/repos/connections
- DELETE /api/repos/connections/:id
- POST /api/repos/connections/:id/sync
- GET /api/repos (500 cap, newest provider_updated first)
- GET /api/repos/:id (full detail incl. clone_url + html_url)

GitHub provider inline for v1 — paginated pull of /orgs/:owner/repos
(when owner set) or /user/repos (when absent), 100/page, capped at 20
pages (~2k repos) to keep first-sync latency bounded. Non-2xx surface
back to the caller as sync_error; parse failures are best-effort per
repo (skipped, logged, don't abort the batch).

Gitea + GitLab providers land in a follow-up — mostly URL swap +
response-shape adapter.

.sqlx/query-2e16848346fdbe69c1616cf480bb1af0b60a7b9164d971f5b553d6cc9a9dd313.json

@@ -0,0 +1,36 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO repos\n            (id, workspace_id, connection_id, provider, external_id,\n             owner, name, description, default_branch, clone_url, html_url,\n             private, stars, forks, provider_updated_at, last_synced_at)\n         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11,\n                 $12, $13, $14, $15, now())\n         ON CONFLICT (connection_id, external_id) DO UPDATE\n            SET owner               = EXCLUDED.owner,\n                name                = EXCLUDED.name,\n                description         = EXCLUDED.description,\n                default_branch      = EXCLUDED.default_branch,\n                clone_url           = EXCLUDED.clone_url,\n                html_url            = EXCLUDED.html_url,\n                private             = EXCLUDED.private,\n                stars               = EXCLUDED.stars,\n                forks               = EXCLUDED.forks,\n                provider_updated_at = EXCLUDED.provider_updated_at,\n                last_synced_at      = now()\n         RETURNING id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Uuid",
+        "Uuid",
+        "Text",
+        "Text",
+        "Text",
+        "Text",
+        "Text",
+        "Text",
+        "Text",
+        "Text",
+        "Bool",
+        "Int4",
+        "Int4",
+        "Timestamptz"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "2e16848346fdbe69c1616cf480bb1af0b60a7b9164d971f5b553d6cc9a9dd313"
+}