test(matrix): deploy↔GitHub-link block integration tests (move exempt→mapped)

[mastermanas805]

What

Closes the D17 / matrix-W6 deploy↔GitHub-link routes in the done-bar route-coverage guard's routeCoverageExemptions with a real DB-backed handler-integration suite, moving the three /api/v1/deployments/:id/github rows exempt → routeTestMap.

Routes moved exempt → mapped

Route	Test
POST /api/v1/deployments/:id/github	TestGitHubDeployBlock_Connect_OwnerHappyPath
GET /api/v1/deployments/:id/github	TestGitHubDeployBlock_Get_ConnectedShape
DELETE /api/v1/deployments/:id/github	TestGitHubDeployBlock_Disconnect_RemovesConnection

New suite

internal/handlers/github_deploy_block_integration_test.go — 15 TestGitHubDeployBlock_* tests driving each route through the production RequireAuth + PopulateTeamRole + RequireWritable chain (NewTestAppWithServices mirrors router.New) against a real Postgres (SetupTestDB). Reuses existing helpers (MustCreateTeamDB, MustSignSessionJWT, seedInternalDeploy, CreateUser, UniqueEmail) — none redefined.

Coverage:

• Happy path (owner): connect 201 / get / disconnect
• Authz model (these routes carry NO RequireRole — ownership is team-scoped):
  • owner 2xx, member-same-team allowed (proves no false owner-only gate)
  • non-member cross-team 404 (never 403 — no existence leak) on all three verbs
  • unauthenticated 401
• Tier gate: anonymous 402 github_requires_paid_tier; hobby 201 (lowest paid tier that can deploy)
• Contract: webhook_url + webhook_secret returned once (64-char hex); already_connected 409; invalid_repo 400; idempotent disconnect (200 deleted=false); not-connected 200 connected=false; encrypt-at-rest (stored secret is ciphertext, not plaintext); cross-team rejection leaves the owner's row intact; default branch → main.

Kept exempt (with sharpened justification)

The github-app integration rows (GET /integrations/github/{install,callback}, POST /webhooks/github, POST /webhooks/github/:webhook_id) stay exempt — they need a real GitHub App (OAuth install redirect, App-secret-HMAC callbacks/webhooks) and the per-connection receiver is HMAC-auth'd with no session chain to drive here; its signature/branch-match/rate-limit/idempotency internals are already covered by the whitebox suites (github_deploy_test.go, github_deploy_receive_arms_coverage_test.go).

Verification

• Failing-then-passing: confirmed the done-bar guard reds without the covering test file and greens with it.
• Both done-bar guards (TestDoneBar_EveryRouteCovered, TestDoneBar_TestMapPointsAtRealTests) GREEN; reverse-drift clean.
• New suite: 15/15 pass against platform DB + Redis.
• go build ./... + go vet ./... clean; touched files gofmt'd.
• Full ./... local reds only on pre-existing env-absence flakes (customer-DB:5434, NATS, GitHub-App config) — identical failure set with my changes stashed, so this PR introduces zero regressions. CI authoritative.

🤖 Generated with Claude Code