fix(pr-review): bind the GitHub App slug on maple-ai so reviews mention the real bot - #1166

🟢 Confidence 5/5 · safe to merge
One key moved between two deploy-time groups; api still binds it through githubAppSourceEnv, so only maple-ai gains a binding.
_{quality 100/100 · no findings · tests not needed · risk low}

Moves GITHUB_APP_SLUG from api's own env list into the shared githubAppSourceEnv group, so maple-ai — which publishes PR reviews — binds the App slug and reviewerMention stops falling back to @maple. Safe to merge.

• githubAppSourceEnv now binds GITHUB_APP_SLUG alongside app id and key
• apps/api drops its own api-only optionalPlain("GITHUB_APP_SLUG")

_{4e4afbf · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple to ask about one.}