Claim Github Installation

Consume a state UUID, fetch installation metadata, write the credential. Authenticated by the state UUID (which was issued to a specific org+user). Session cookie is optional — if present, defense-in-depth checks `session.user_id == row.initiated_by_user_id`. If absent (cookie expired during the GitHub detour), the state alone is sufficient. All errors raise BotyardError subclasses so the central handler emits RFC 9457 Problem Details with the right ``error_code`` for the frontend.

curl -X POST "https://example.com/v1/integrations/github/claim" \  -H "Content-Type: application/json" \  -d '{    "state": "string",    "installation_id": 0,    "setup_action": "install"  }'

{
  "credential_id": "string",
  "org_slug": "string"
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "error_code": "string",
  "errors": [
    {
      "pointer": "string",
      "detail": "string",
      "type": "string"
    }
  ],
  "trace_id": "string"
}