Foundation for every other GitHub feature. Register one Hollahoop GitHub App globally; let org owners install it on their GH org with selected repos. Persist installation_id, account_login and installed_by in a new github_installations table keyed by org_id. Mint installation tokens on demand via @octokit/auth-app (1h TTL, in-memory cached). New webhook route /api/integrations/github/webhook with HMAC signature verification and a webhook_events idempotency log. Org settings gets a GitHub card with Install / Reinstall / Uninstall.

Out of scope: per-project repo linking (separate post), per-post issue linking (separate post), inbound event handlers (separate post). This card only delivers a working install + token mint + signed webhook receiver that logs events to a table.