fix(orb): cache brokered installation tokens to stop GitHub token-mint throttling

[JSONbored]

Summary

The brokered token endpoint (POST /v1/orb/token) minted a fresh GitHub installation token on every call — no server-side cache. GitHub installation tokens are valid ~1h, so minting that often throttles GitHub's token-creation endpoint (measured 16-20s responses from the live VPS, with the 3rd sequential mint timing out entirely). The engine aborts the broker call at 10s, so it can never complete a throttled mint → falls back to its in-memory cache (orb_broker_degraded_serving_cached_token) or, once that lapses (e.g. after a container restart), throws orb_broker_unavailable — which blocks reviews. (Diagnosed live: secret valid, relay registered, /health 0.57s, but /v1/orb/token 16-20s.)

Fix:

1. Server-side token cache (brokerOrbToken): cache the minted token on the enrollment row (cached_token_json, migration 0081), encrypted at rest (AES-256-GCM via TOKEN_ENCRYPTION_SECRET — the same scheme as the relay secret), folded into the SELECT the broker already does (no extra read). Serve a still-fresh cached token (≥10m before expiry) instead of minting → GitHub is minted at most once per install per ~hour → throttling clears, and the cache survives engine restarts. Skipped (mint-every-call, as before) when no encryption key is set.
2. Timeout headroom for the cold transition mint: the broker's GitHub mint (createOrbInstallationToken) and the engine's broker call (BROKER_TIMEOUT_MS) get a generous timeout so the one uncached mint during the throttled transition completes and populates the cache; steady-state cache hits return in well under a second.

Closes #1633.

Scope

• Conventional Commit title; focused (broker + its mint/timeout + a 1-column migration + tests).
• No site//CNAME/Pages; follows CONTRIBUTING.md.
• DB change → contiguous migrations/0081_*.sql committed (Phase 4).

Validation

• git diff --check · actionlint · db:migrations:check · typecheck
• test:coverage — new broker tests cover every arm: cache hit (GitHub minted once across two exchanges; stored ciphertext, never plaintext), near-expiry re-mint, unparseable-cache fallthrough (read catch), and a fail-safe cache-write error (mint still succeeds + warns). Existing no-encryption-key tests cover the cache-skip branches.
• test:workers · build:mcp · test:mcp-pack · ui:* · npm audit --audit-level=moderate

If any required check was skipped, explain why:

• No OpenAPI/cf-typegen: response shape + bindings unchanged (token-mint internals only).

Safety

• No secrets/wallets/trust-scores in code/tests/PR text. The cached token is a short-lived (~1h) GitHub credential stored encrypted at rest on the enrollment row (mirrors the existing encrypted relay secret); the cache test asserts the ciphertext never contains the plaintext token.
• Auth/eligibility unchanged — the enrollment-secret validation + install eligibility gate still run on every exchange (the cache only skips the GitHub mint), and the negative-path tests (invalid/revoked enrollment, ineligible install) are unchanged + green.
• No public GitHub text change.

Notes

• brokerOrbToken + the mint run on the cloud Orb (gittensory-api, auto-deploys on merge); BROKER_TIMEOUT_MS runs on the self-host engine (ships on the next rebuild).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.53%. Comparing base (b1631fb) to head (c374210).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1634   +/-   ##
=======================================
  Coverage   95.52%   95.53%           
=======================================
  Files         204      204           
  Lines       22063    22084   +21     
  Branches     7968     7972    +4     
=======================================
+ Hits        21076    21097   +21     
  Misses        412      412           
  Partials      575      575           

Files with missing lines	Coverage Δ
src/orb/app-auth.ts	100.00% <100.00%> (ø)
src/orb/broker-client.ts	100.00% <100.00%> (ø)
src/orb/broker.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.