Support GitHub sign-in with per-user kubeconfig setup

[Che-Zhu]

Goal

Use GitHub as Fulling's authentication provider, then let each authenticated user configure the kubeconfig that powers their Kubernetes access.

Kubeconfig is runtime infrastructure configuration, not a login credential and not a source of user identity.

Product direction

• GitHub is the only sign-in provider.
• Better Auth stores users, GitHub provider accounts, and sessions in PostgreSQL.
• Anonymous users must sign in before opening the workspace or kubeconfig settings.
• Each authenticated user may store one kubeconfig.
• Browser APIs expose only whether kubeconfig is configured and when it was updated; they never return the stored content.
• Runtime code obtains Kubernetes access through getK8sServiceForUser(userId).
• Sealos JWT login, password login, and kubeconfig-as-login are not part of this foundation.

Work to scope

• Provide GitHub OAuth sign-in through Better Auth.
• Create or reuse the GitHub-backed user and provider account, then persist a database session.
• Redirect authenticated users to the protected workspace entry.
• Provide an authenticated settings flow to save, replace, and delete the current user's kubeconfig.
• Validate kubeconfig before saving it, including authenticated Kubernetes SelfSubjectReview.
• Keep kubeconfig content out of session payloads, browser-readable responses, logs, and public metadata.
• Preserve the user-scoped Kubernetes boundary through getK8sServiceForUser(userId).
• Verify the flow against an authorized GitHub OAuth App before release.

Acceptance criteria

• GitHub is the only sign-in method presented to users.
• A successful GitHub sign-in creates or reuses the corresponding User and Account and creates a persistent Session.
• Anonymous workspace and kubeconfig settings requests redirect to login.
• An authenticated user can save, replace, and delete their kubeconfig.
• Invalid or unauthenticated kubeconfig is rejected before it is stored.
• Kubeconfig content is never returned by browser-facing APIs or included in logs or sessions.
• getK8sServiceForUser(userId) uses the kubeconfig belonging to that user.
• No Sealos JWT, password, or kubeconfig-based login path remains.
• Lint, unit tests, browser tests, and the production build pass.