feat(auth): GitHub App auth, OIDC middleware, secret masking (Phase 5 — T5.1–T5.3)

[canonical-muhammadbassiony]

Summary

Implements authentication and security hardening for the API, completing Phase 5 of spec 001.

Tasks Implemented

• T5.1: GitHub App authentication as first fallback in GetGitHubToken(). When GITHUB_APP_ID is set, signs a short-lived RS256 JWT with the App private key and exchanges it for an installation access token. PAT env vars and gh auth token remain as lower-priority fallbacks. Supports PEM from file (GITHUB_APP_PRIVATE_KEY_PATH) or env var (GITHUB_APP_PRIVATE_KEY with literal \n handling).
• T5.2: internal/auth/middleware.go with JWTMiddleware — validates Bearer tokens against JWKS fetched from the OIDC issuer discovery document. Bypassed when BAUER_OIDC_ISSUER is unset (safe for local dev). Protected endpoints (workflows, issues, jira webhook) wrapped with middleware on a separate sub-mux. Health/readiness probes remain on public mux.
• T5.3: internal/logging/masking.go with MaskSecret and MaskPath helpers. Full table-driven unit tests (9 cases). Audit of existing slog calls confirmed no raw token/credential logging.

Security Notes

• RS256 JWT signing for GitHub App tokens
• OIDC middleware validates issuer, audience, signature, and expiry
• Fail-closed when OIDC is configured but JWKS fetch fails (returns 503)
• Masking helpers handle edge cases (empty, short ≤4 chars, longer strings)

Files Changed

• internal/github/auth.go — GitHub App token generation
• internal/auth/middleware.go — OIDC JWT validation middleware
• internal/logging/masking.go — MaskSecret, MaskPath
• internal/logging/masking_test.go — unit tests
• cmd/app/main.go — public vs protected mux split
• go.mod / go.sum — golang-jwt/jwt/v5, lestrrat-go/jwx/v2

How to Review

git diff feat/phase-4-api-endpoints..feat/phase-5-auth-security -- .

Part of the Bauer v2 stacked PR series (Branch 11 of 12).