Fallback to gh CLI credentials if available (#1515)

Adds `gh` CLI as a GitHub credential fallback for users who already have
`gh auth login` configured locally. OpenChamber-owned OAuth credentials
remain the primary source of truth; the `gh` token is only used when no
stored OpenChamber GitHub access token exists and the fallback is not
disabled.

The fallback is implemented as a credential provider only: GitHub features
continue to use the existing Octokit/GitHub API paths for issues, pull
requests, checks, merges, and related operations. The PR does not replace
those endpoints with `gh issue` or `gh pr` CLI commands.

Server changes:
- Add `gh-cli-credential.js` to read `gh auth token` with a bounded timeout.
- Cache the `gh` token lookup for 30 seconds, including negative results,
  to avoid repeated subprocess spawning on status/polling paths.
- Hide the subprocess window on Windows via `windowsHide: true`.
- Clear the gh CLI token cache when the fallback setting changes.
- Update `getOctokitOrNull()` to prefer stored OpenChamber OAuth tokens and
  fall back to the `gh` token only when enabled.
- Add `ghCliDisabled` persistence in the existing settings file with atomic
  writes and `0o600` file permissions.
- Add `POST /api/github/auth/gh-cli` to enable or disable the fallback.
- Extend `/api/github/auth/status` with `ghCli` metadata: availability,
  disabled state, active state, and active user when applicable.

UI/runtime changes:
- Extend `GitHubAuthStatus` and `GitHubAPI` with gh CLI fallback metadata
  and toggle support.
- Add web RuntimeAPI support for toggling the gh CLI fallback through
  `runtimeFetch`, preserving active runtime/remote target behavior.
- Add deterministic VS Code unsupported handling for the gh CLI toggle.
- Update GitHub Settings to show gh CLI availability and active status.
- When gh CLI is the active auth source, show it in the connected account
  card and offer Disable instead of Disconnect.
- Keep Add Account available so users can still connect an OpenChamber OAuth
  account, which then takes priority over gh CLI.
- Add localized gh CLI settings strings across supported settings locales.

Fixes addressed during review:
- Removed unreachable UI branches in the inactive gh CLI card.
- Avoided duplicate and repeated `gh auth token` subprocess calls.
- Hardened settings file permissions for the new persisted flag.
- Routed the gh CLI toggle through the RuntimeAPI/runtimeFetch path instead
  of direct browser `fetch`.
- Added targeted tests for hidden subprocess options and negative-result
  cache behavior.
- Fixed a VS Code webview Response body typing issue that blocked type-check.

packages/ui/src/lib/i18n/messages/pl.settings.ts

@@ -246,6 +246,15 @@ export const settingsDict = {
   'settings.github.page.toast.disconnectFailed': 'Nie udało się odłączyć GitHub',
   'settings.github.page.toast.disconnected': 'Odłączono od GitHub',
   'settings.github.page.toast.startConnectFailed': 'Nie udało się rozpocząć połączenia z GitHub',
+  'settings.github.page.toast.ghCliEnabled': 'Rezerwa gh CLI włączona',
+  'settings.github.page.toast.ghCliDisabled': 'Rezerwa gh CLI wyłączona',
+  'settings.github.page.toast.ghCliUpdateFailed': 'Nie udało się zaktualizować ustawienia gh CLI',
+  'settings.github.page.ghCli.title': 'gh CLI',
+  'settings.github.page.ghCli.activeDescription': 'Uwierzytelniono przez gh CLI',
+  'settings.github.page.ghCli.fallbackDescription': 'Dostępne jako rezerwa, jeśli uwierzytelnienie OpenChamber zostanie usunięte',
+  'settings.github.page.ghCli.disabledDescription': 'Zainstalowane, ale nieużywane jako rezerwa',
+  'settings.github.page.ghCli.actions.disable': 'Wyłącz',
+  'settings.github.page.ghCli.actions.enable': 'Włącz',
   'settings.github.page.tooltip.connectAccount': 'Połącz konto GitHub, aby korzystać z przepływów pracy dla PR i Issue w aplikacji.',
   'settings.magicPrompts.page.actions.resetAllOverrides': 'Zresetuj wszystkie nadpisania',
   'settings.magicPrompts.page.actions.resetToDefault': 'Zresetuj do domyślnych',