feat(repositories): add self-service onboarding API

[vigneshrajsb]

Summary

• Adds self-service repository onboarding APIs under /api/v2/repositories.
• Uses active repositories rows (deletedAt IS NULL) as the source of truth for onboarded repos.
• Adds installed GitHub repo caching with github:installed:{installationId} and webhook membership caching with github:onboarded:{installationId}:{githubRepositoryId}.
• Updates GitHub webhook handling so repo-scoped events for non-onboarded repos are acknowledged with 200 and skipped.
• Handles repository rename webhooks by syncing DB metadata and patching existing installed/onboarded cache entries by stable GitHub repository id.
• Adds route/service/cache/webhook tests using neutral fixture data.

API

• GET /api/v2/repositories?view=onboarded
• GET /api/v2/repositories?view=all
• POST /api/v2/repositories
• DELETE /api/v2/repositories/{owner}/{repo}

Auth behavior follows the existing v2 middleware: when ENABLE_AUTH=true, these routes require bearer auth; when auth is disabled, they remain accessible for the current internal deployment setup.

Local E2E Validation

Tested locally through Tilt/kind with GitHub App webhooks:

• Non-onboarded repo PR events were received and skipped with repository_not_onboarded, returning 200.
• Onboarded repo PR events were received, queued, and processed.
• Onboarding a repo through POST /api/v2/repositories created an active DB row and wrote a positive onboarded Redis cache value.
• After onboarding, a new PR event for that repo processed successfully and created a build.
• Removing the repo through DELETE /api/v2/repositories/{owner}/{repo} soft-deleted the DB row and wrote a short-lived negative onboarded Redis cache value.
• After removal, new PR events for that repo were skipped with repository_not_onboarded.
• Repository rename webhook updated the DB row and onboarded cache by GitHub repository id.
• Repository rename webhook patched the installed cache in place when github:installed:{installationId} was present.
• view=onboarded, view=all, and view=all&onboarded=false returned the expected UI-facing states across onboard/remove transitions.

Verification

• pnpm run lint passed.
• Focused repository/GitHub/auth Jest tests passed.
• pnpm test passed: 157 suites, 1433 tests.
• pnpm run ts-check still fails on the existing repo-wide baseline. A filtered scan for files touched by this PR produced no TypeScript errors after cleanup.