Claim your project via GitHub OAuth #22

Why

Teams want to fix their name, tagline, demo link and track. Letting a repo contributor edit their own project cleans the data for free, and hackers asked for it.

What to build

• GitHub OAuth with the read:user scope only, handled by the API with a session cookie. A user may edit a project if their login is in that repo's contributors (repo_contributors).
• Editable fields: display name, tagline, demo_url, video_url and track. Everything else stays derived. Names and taglines come from the repo and description today, and track from the README, so edits are overrides and never replace the derived values.
• A project_edits table. Edits are pending until a maintainer approves them on a review page (gated by a maintainer logins setting). Approved overrides are applied when reading (queries.py) and in the export, never by editing derived tables.
• Audit: every override records who, when, and from what to what.

Acceptance criteria

• A contributor can log in, edit and see "pending review". A non contributor sees "you're not listed on this repo".
• Overrides survive a full reconcile run, which rebuilds projects.

See CONTRIBUTING.md for conventions.