fix(github): improve GitHub App setup and installation flow

- resolve the GitHub App by a stable identifier during installation
  callbacks so installing and re-installing keeps working over the
  full lifetime of the App
- verify the installation id received from the callback against the
  GitHub API before persisting it
- support re-installing an already configured GitHub App instead of
  blocking it
- require an authenticated session and rate limit the setup callback
  routes
- extend manifest setup state validity to match GitHub's manifest
  code lifetime

Adds feature coverage for the GitHub App setup and installation
callbacks.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

resources/views/livewire/source/github/change.blade.php

@@ -290,8 +290,8 @@
                 function createGithubApp(webhook_endpoint, preview_deployment_permissions, administration) {
                     const {
                         organization,
-                        uuid,
-                        html_url
+                        html_url,
+                        uuid
                     } = @json($github_app);
                     if (!webhook_endpoint) {
                         alert('Please select a webhook endpoint.');
@@ -299,6 +299,7 @@
                     }
                     let baseUrl = webhook_endpoint;
                     const name = @js($name);
+                    const manifestState = @js($manifestState);
                     const isDev = @js(config('app.env')) ===
                         'local';
                     const devWebhook = @js(config('constants.webhooks.dev_webhook'));
@@ -340,7 +341,7 @@
                     };
                     const form = document.createElement('form');
                     form.setAttribute('method', 'post');
-                    form.setAttribute('action', `${html_url}/${path}?state=${uuid}`);
+                    form.setAttribute('action', `${html_url}/${path}?state=${manifestState}`);
                     const input = document.createElement('input');
                     input.setAttribute('id', 'manifest');
                     input.setAttribute('name', 'manifest');