feat(discord): comment on GitHub as the linked user via slash/context commands

Replace the App-identity !gh text command with native slash and message
context-menu commands. /gh login|logout link a Discord user to their GitHub
account; /gh comment add|edit|del and the right-click 'GitHub' commands open
a modal and create/edit/delete comments using the user's own OAuth token,
delegating permission checks to GitHub (surfacing 401/403/404). The gateway
registers guild commands on connect and handles interactions in the DO.

src/github-oauth.ts

@@ -49,3 +49,104 @@ export async function getUserOctokit(userId: string, kv: KVNamespace): Promise<O
   if (!token) return null;
   return new Octokit({ auth: token });
 }
+
+/**
+ * Map an Octokit REST error to a stable, translatable code the caller can
+ * turn into a user-facing message.
+ */
+function mapGitHubError(err: unknown): Error {
+  const status = (err as { status?: number })?.status;
+  if (status === 401) return new Error("GITHUB_TOKEN_EXPIRED");
+  if (status === 403) return new Error("GITHUB_FORBIDDEN");
+  if (status === 404) return new Error("GITHUB_NOT_FOUND");
+  return err instanceof Error ? err : new Error(String(err));
+}
+
+async function requireOctokit(kv: KVNamespace, githubUserId: string): Promise<Octokit> {
+  const octokit = await getUserOctokit(githubUserId, kv);
+  if (!octokit) throw new Error("GITHUB_TOKEN_EXPIRED");
+  return octokit;
+}
+
+/**
+ * Post an issue/PR comment AS the given GitHub user (their OAuth token),
+ * so the comment shows up under their own identity instead of the bot.
+ */
+export async function commentAsUser(
+  kv: KVNamespace,
+  githubUserId: string,
+  owner: string,
+  repo: string,
+  issueNumber: number,
+  body: string,
+): Promise<{ htmlUrl: string; login: string }> {
+  const octokit = await requireOctokit(kv, githubUserId);
+  try {
+    const { data: me } = await octokit.rest.users.getAuthenticated();
+    const res = await octokit.rest.issues.createComment({
+      owner,
+      repo,
+      issue_number: issueNumber,
+      body,
+    });
+    return { htmlUrl: res.data.html_url, login: me.login };
+  } catch (err) {
+    throw mapGitHubError(err);
+  }
+}
+
+/** Fetch a single issue comment's current body (used to prefill the edit modal). */
+export async function getCommentAsUser(
+  kv: KVNamespace,
+  githubUserId: string,
+  owner: string,
+  repo: string,
+  commentId: number,
+): Promise<{ body: string; login: string }> {
+  const octokit = await requireOctokit(kv, githubUserId);
+  try {
+    const res = await octokit.rest.issues.getComment({ owner, repo, comment_id: commentId });
+    return { body: res.data.body ?? "", login: res.data.user?.login ?? "" };
+  } catch (err) {
+    throw mapGitHubError(err);
+  }
+}
+
+/** Edit an existing issue/PR comment. GitHub enforces permission (403 if not allowed). */
+export async function editCommentAsUser(
+  kv: KVNamespace,
+  githubUserId: string,
+  owner: string,
+  repo: string,
+  commentId: number,
+  body: string,
+): Promise<{ htmlUrl: string }> {
+  const octokit = await requireOctokit(kv, githubUserId);
+  try {
+    const res = await octokit.rest.issues.updateComment({
+      owner,
+      repo,
+      comment_id: commentId,
+      body,
+    });
+    return { htmlUrl: res.data.html_url };
+  } catch (err) {
+    throw mapGitHubError(err);
+  }
+}
+
+/** Delete an existing issue/PR comment. GitHub enforces permission (403 if not allowed). */
+export async function deleteCommentAsUser(
+  kv: KVNamespace,
+  githubUserId: string,
+  owner: string,
+  repo: string,
+  commentId: number,
+): Promise<void> {
+  const octokit = await requireOctokit(kv, githubUserId);
+  try {
+    await octokit.rest.issues.deleteComment({ owner, repo, comment_id: commentId });
+  } catch (err) {
+    throw mapGitHubError(err);
+  }
+}