PR #1774 - ReviewStage/luke

Summary

Why: a developer who signed in with GitHub had to authorize GitHub a second time on the Plans tab. Sign-in asked for read:user and user:email, and planning needs repo.
Scopes: GITHUB_SIGN_IN_SCOPES in auth-policy.ts is now read:user, user:email, repo, and auth.ts uses it.
Token refresh: updateAccountOnSignIn is now true, so a GitHub sign-in replaces the stored token. It was false only so a narrow sign-in token could not overwrite the linked one. Sign-in and Connect GitHub now ask for the same scopes. An existing GitHub account gets repo on its next GitHub sign-in.
Still connects once: Google sign-ins, and existing GitHub accounts that have not signed in again yet. A user who refuses repo on GitHub's consent screen gets access-denied, and the Plans tab offers Connect GitHub, as before.
Trade-off: every GitHub sign-in now asks for full read and write access to the user's repos, including users who never plan. GitHub's best-practices page asks for minimal scopes and recommends GitHub Apps. We chose this as the simplest fix.
PRIVACY.md: "Your account" now says GitHub sign-in grants repo, what that covers, what Luke reads with it, and how to revoke it. "Last updated" is now 4 October 2026. docs/PLANNING.md and the code comments are updated to match.

./scripts/check.sh exit 0.
New test apps/web/tests/auth-github-sign-in.test.ts runs a real Better Auth GitHub sign-in against a fake GitHub:
- sign-in asks for repo, and the token it stores reads repositories;
- a second sign-in replaces a profile-only token with one that has repo.
  Both fail with the old scopes and updateAccountOnSignIn: false.
Removed the constant check updateAccountOnSignIn === false from auth-database.test.ts. The new behavior test covers that setting.
No desktop or UI code changed. Not exercised against live GitHub.

🤖 Generated with Claude Code