Goal

Turn the provisioned App + its installation into usable, cached repo access tokens.

Acceptance Criteria

• Handle the installation callback (post-install redirect) and persist installation_id
• Sign an App JWT with the stored PEM
• Exchange it via POST /app/installations/{id}/access_tokens for a ~1h installation token
• Cache tokens and refresh on expiry

Notes

See AgDR-0005. Parent: #23.

Capture is via the post-install redirect (?installation_id=…&setup_action=install); the installation/push webhook receiver + HMAC signature verification is the separate scope of #61.

Migration

This feature adds the github_installation table (FK → github_app). Schema migration is tracked on this ticket (label migration) — additive new table, zero blast radius.

Migration AgDR: docs/agdr/AgDR-0013-migration-github-installation-table.md
Token-strategy AgDR: docs/agdr/AgDR-0012-installation-token-strategy.md