#3364 [comp] Production Deploy

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Adds ISMS document versioning and history (CS-701) and a read‑only GitHub App integration using an installation-based OAuth flow (CS-710). Ensures exports are audit-safe and approvals are serialized to prevent double‑publish.

• New Features

  • ISMS API: GET /v1/isms/documents/:id/versions for history. Exports accept optional versionId and default to the current published artifact (draft only when never published).
  • Data model: IsmsDocument adds currentVersionId, draftNarrative, and draftSnapshot. Approval freezes an immutable version with a contentSnapshot. Edits write to the draft and invalidate approval.
  • Export integrity: Per-version downloads serve the stored file or re-render from the immutable snapshot; never from live data. Default export serves the current published version when one exists.
  • Concurrency safety: Approve/decline take a per-document advisory lock and atomically claim status to prevent double‑publish. All edits acquire the same lock via centralized approval invalidation. Control link add/remove now locks before writing so those mutations serialize with approve.
  • UI: Version history with per-version PDF/DOCX download, accessible labels, and a clear “Published vN / editing creates a new draft” state. Fixes: legacy approvals respected without published versions; Scope form re-seeds when draftNarrative changes; minor banner formatting.
  • Integrations: New github-app manifest adds a fine‑grained, read‑only GitHub App connection. OAuth supports appInstallFlow (start redirects to the App install URL with state only; GitHub ignores redirect_uri). The legacy github OAuth integration is unchanged. The install callback no longer persists installation_id (unverified).

• Migration

  • Schema: updates IsmsDocument/IsmsDocumentVersion; adds Member.publishedIsmsVersions. Legacy pre-version rows are dropped; existing approvals remain, and the next approval creates the first real published version.
  • No manual steps. Exports for never‑published docs render the current draft until the first approval. S3 uploads for retained artifacts are handled via AttachmentsModule.