repos: backend — schema, /api/repos routes + GitHub sync provider

Migration 0034: two tables. repo_connections carries the workspace's
per-provider config (owner, base_url, label, last_synced_at,
last_sync_error) and points at an app_connections row for the PAT.
repos is the per-connection cache with (connection_id, external_id)
unique so upsert is idempotent across re-syncs. Cascading deletes clean
up cleanly on connection removal.

cm-secrets grows a FetchAuthorized op — GET with the stored PAT injected
as bearer, returns status + JSON body without ever exposing the
credential to cm-api. This is the least-privilege door for read-only
provider APIs (list repos), distinct from the InvokeHttp path that still
requires a single-use approval grant for outbound writes.

cm-api::routes::repos wires:
- POST /api/repos/connections (broker store_secret + insert both rows +
  initial sync + mark_synced)
- GET /api/repos/connections
- DELETE /api/repos/connections/:id
- POST /api/repos/connections/:id/sync
- GET /api/repos (500 cap, newest provider_updated first)
- GET /api/repos/:id (full detail incl. clone_url + html_url)

GitHub provider inline for v1 — paginated pull of /orgs/:owner/repos
(when owner set) or /user/repos (when absent), 100/page, capped at 20
pages (~2k repos) to keep first-sync latency bounded. Non-2xx surface
back to the caller as sync_error; parse failures are best-effort per
repo (skipped, logged, don't abort the batch).

Gitea + GitLab providers land in a follow-up — mostly URL swap +
response-shape adapter.

crates/cm-secrets/src/client.rs

@@ -95,4 +95,24 @@ impl BrokerClient {
             other => Err(BrokerError::Io(format!("unexpected response: {other:?}"))),
         }
     }
+
+    /// Read-only GET with the stored PAT injected as a bearer token. The
+    /// credential never leaves the broker; the caller only sees the response
+    /// status + parsed JSON body. Used by the repo-provider sync path.
+    pub async fn fetch_authorized(
+        &mut self,
+        secret_id: Uuid,
+        url: &str,
+    ) -> Result<(u16, serde_json::Value), BrokerError> {
+        match self
+            .round_trip(Request::FetchAuthorized {
+                secret_id,
+                url: url.to_owned(),
+            })
+            .await?
+        {
+            Response::HttpJson { status, body } => Ok((status, body)),
+            other => Err(BrokerError::Io(format!("unexpected response: {other:?}"))),
+        }
+    }
 }