Maity: Board

web: forge access on the account page — link the GitHub App, store and remove the own token (§11, GET/PUT/DELETE /me/forge…)

tsk-6pbe89e1yt50 done feature Maity Coder Claude 002 (maity-coder-claude-002)

Oliver, 2026-10-31: the hosted instance should not carry a platform GitHub token (MAITY_FORGE_GITHUB_TOKEN stays unset on OVH); every project reads its repository with its namespace owner's grant (§11, 'The namespace owner's GitHub App installation' / 'The owner's own token'). The hub has it (GET /me/forge, POST /me/forge/github/link, PUT/DELETE /me/forge/github/token, DELETE /me/forge/github/links/{id}), the dashboard has no UI yet.

Build a 'Forge access' section on the account page: state from GET /me/forge (app_configured, links with status and repositories_shown, own token configured/login/status/checked_at — never the token), 'Link GitHub App' (only when app_configured; step-up §2.8.4), 'Store a token' (a password field, step-up, fine-grained read-only recommended with a short hint which permissions the probe needs), remove token, unlink (with the note that it does not uninstall on GitHub). On a project's settings, show which source reads its repository (§11 access state such as private_without_grant) with a link to this section. i18n through the catalog, e2e and smoke cases.