[Story]: GitHub org/user discovery & multi-repo ingestion selection

[adoLime]

User Story

As an Admin, I want to enter a GitHub organization or user (e.g. SprintStartProject or https://github.com/SprintStartProject) and get a selectable list of all their public and accessible private repos, so that I can pick the repos to ingest in one flow instead of adding each repo manually.

Context & Motivation

• Type: Functional (Connectors & Ingestion UX)
• Parent epic: 03 EPIC - Connectors & Artifact Ingestion #52 (03 EPIC – Connectors & Artifact Ingestion)
• Teams: team:backend (org/user repo-list endpoint), team:frontend (selection UI)
• Builds on: [Story]: GitHub repository connector v0 (commits, files, issues, PR metadata) #159 (closed — GitHub repository connector v0, single-repo connect via POST /api/v1/github/connect with owner + name). This story adds discovery + multi-select on top of that single-repo connect flow; each selected repo reuses the existing connect endpoint.
• Related: [Story]: PM-managed functional project roles + connector/source gating #175/[Feature]: Connector/source gating #212 (Sprint 4 — connector/source gating/allowlist; this story is discovery + onboarding of many repos, [Story]: PM-managed functional project roles + connector/source gating #175/[Feature]: Connector/source gating #212 is gating already-connected sources), Create ADR Template #35 (Sprint 4 — granular update control), [Feature]: Data Ingestion Page (per source) #189 (closed — Data Ingestion Page, where the new flow lives).

Acceptance Criteria

• An Admin can enter a GitHub organization (e.g. SprintStartProject) or a user (e.g. github.com/username), plus select a stored GitHub token (PAT).
• The system lists all repos under that org/user (name, description, public/private, last activity) using the GitHub API (GET /orgs/{org}/repos or GET /users/{user}/repos), paginated, with a search/filter box.
• Private repos are listed only if the selected token has the required scope (e.g. read:org / repo access); otherwise the list shows public repos only with a hint that private repos require a broader token.
• The Admin can multi-select repos from the list.
• Repos already connected to SprintStart are marked with a "connected" badge so double-connection is visible.
• "Connect selected" starts ingestion for each selected repo by reusing the existing single-repo connect flow ([Story]: GitHub repository connector v0 (commits, files, issues, PR metadata) #159 POST /api/v1/github/connect per repo, or a batch endpoint that wraps it).
• Each connected repo becomes a separate source (consistent with today's single-repo model) — no new org-level source type.
• Discovery is manual — re-running the discovery shows newly added repos in the org/user; no automatic background discovery.
• Access is Admin-only (hasRole('ADMIN')); non-Admins get 403 (RBAC [Story]: RBAC with Admin / User separation #93).
• Empty / loading / error states (e.g. org not found, token invalid, rate-limited by GitHub); i18n (en/de).

Sub-Tasks (by team)

• Backend — new endpoint GET /api/v1/github/discover?owner={org-or-user}&tokenName={token} that returns the paginated repo list (reuses the existing GitHub client + token mechanism); Admin-only. Optionally a batch-connect endpoint, or the frontend calls the existing single-repo connect per selected repo.
• Frontend — extend the Data Ingestion page (SourceConnectModal / new "Discover from org" flow): org/user input → paginated selectable repo list (search/filter + multi-select + "connected" badge) → "Connect selected" bulk action.
• QA — tests for: org vs. user discovery, pagination, private-repo scope handling, multi-select + bulk connect, "connected" badge rendering, Admin-only 403, empty/error/rate-limited states.

Dependencies

• Reuses (no rebuild): [Story]: GitHub repository connector v0 (commits, files, issues, PR metadata) #159 (single-repo connect endpoint), existing GitHub client + PAT storage ([Story]: Keep secrets out of the repo #94/[Story]: GitHub Actions secrets configured for CI #126), DataIngestionPage ([Feature]: Data Ingestion Page (per source) #189).
• Related: [Story]: PM-managed functional project roles + connector/source gating #175/[Feature]: Connector/source gating #212 (source gating), Create ADR Template #35 (granular updates), [Story]: RBAC with Admin / User separation #93 (RBAC).
• No hard blocker — builds on done foundations ([Story]: GitHub repository connector v0 (commits, files, issues, PR metadata) #159, [Feature]: Data Ingestion Page (per source) #189).