test(matrix): deploy↔GitHub-link block integration tests (move exempt→mapped)

Close the D17 / matrix-W6 deploy↔GitHub-link routes in the done-bar
route-coverage guard's routeCoverageExemptions with a real DB-backed
handler-integration suite, moving the three /api/v1/deployments/:id/github
rows exempt → routeTestMap.

New suite (internal/handlers/github_deploy_block_integration_test.go,
TestGitHubDeployBlock_*, 15 tests) drives each route through the production
RequireAuth + PopulateTeamRole + RequireWritable chain
(NewTestAppWithServices mirrors router.New) against a real Postgres:

  POST   /api/v1/deployments/:id/github  → Connect
  GET    /api/v1/deployments/:id/github  → Get
  DELETE /api/v1/deployments/:id/github  → Disconnect

Coverage: happy path (owner), member-same-team allowed (no false owner-only
gate — these routes carry NO RequireRole), non-member cross-team 404 (never
403, no existence leak), unauth 401, tier gate (anonymous 402 /
hobby-allowed 201), contract (webhook_url + secret-once-64char,
already_connected 409, invalid_repo 400, idempotent disconnect,
not-connected 200, encrypt-at-rest ciphertext persisted).

The github-app integration rows (install/callback redirect, App-secret-HMAC
webhooks) and the per-connection PUBLIC receive endpoint
(/webhooks/github/:webhook_id, HMAC-auth'd, no session chain) stay exempt
with sharpened justifications — they need a real GitHub App and have no
RequireAuth chain to drive; the receiver's signature/branch/rate-limit/
idempotency internals are covered by the whitebox suites.

Both done-bar guards stay GREEN (failing-then-passing verified: the guard
reds without the covering tests). New gate-relevant tests pass; full ./...
local reds only on pre-existing env-absence flakes (customer-DB:5434, NATS,
GitHub-App config) — identical failure set with changes stashed, so this PR
introduces zero regressions. CI authoritative.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mastermanas805