[Fix] Link GitHub account 404s when app credentials are stored in deployment env vars

[mrubens]

Problem

Clicking Link GitHub (Settings → Linked accounts, onboarding, home onboarding card) redirected to github.com/login/oauth/authorize?client_id=&..., which GitHub 404s.

startAuthenticateGitHubAccountCommand built the authorize URL from Env.GITHUB_CLIENT_ID, which only reads process env and defaults to an empty string. Deployments that created their GitHub App through the in-product manifest flow store credentials encrypted in the environment_variables table, so the client id was empty at URL-build time.

getGitHubOAuthUser (the callback's code→token exchange, shared with OAuth-on-install linking) read both GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET the same way, so the callback would have failed even with a correct URL.

Fix

• Resolve the client id via resolveDeploymentEnvVar (process env first, then DB-stored deployment credentials), matching the rest of the GitHub commands.
• When no client id is configured, return a clear error ("Configure a GitHub App for this deployment before linking your GitHub account...") instead of emitting a broken URL. The settings UI already toasts result.error.
• Same treatment for the client id + secret in getGitHubOAuthUser.

Testing

• New unit tests: authorize URL built from the deployment-resolved client id; unconfigured deployments get the error result instead of a URL.
• All 11 tests in mutations.test.ts pass; typecheck, Prettier, ESLint clean.
• Verified at runtime against a dev deployment configured via the manifest flow (no GITHUB_CLIENT_ID in process env): the credentials now resolve from the DB and the link flow reaches GitHub's authorize page.

[roomote-roomote]

No code issues found. See task

Reviewed the credential-resolution fix in apps/web/src/trpc/commands/github/mutations.ts and its tests. resolveDeploymentEnvVar returns a trimmed non-empty string or null, so the !clientId/!clientSecret guards are correct, both the authorize-URL builder and the shared code-to-token exchange are fixed, and all three UI entry points (onboarding step, home onboarding card, linked-accounts settings) already surface the new success: false error via toast.