[MekDrop]

Summary

• Adds worker/src/routes/auth.js with a githubCallback handler that implements the GitHub OAuth code-for-token exchange
• On success, redirects the user to ${SPA_URL}/#/auth/github?token=<access_token>
• On failure (missing code or token exchange error), redirects to ${SPA_URL}/#/login?error=<message>
• Registers the route GET /auth/github/callback in worker/src/index.js

Test plan

• Deploy worker to a preview environment with GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, and SPA_URL set
• Initiate the OAuth flow from the SPA and verify a successful redirect lands at /#/auth/github?token=...
• Hit /auth/github/callback with no code param and verify redirect to /#/login?error=missing_code
• Simulate a bad code and verify redirect to /#/login?error=<github error message>
• Confirm GITHUB_CLIENT_SECRET never appears in any response body or log

Closes #6