miner-ui(hosted): GitHub OAuth tenant auth and server-side tenant scoping of every dashboard surface

[JSONbored]

Context

Part of the hosted AMS chat platform epic; builds on the hosted-mode flag sub-issue (blocked on it — hosted mode must exist to have a session to scope). Locally the miner dashboard has a single implicit operator; hosted, every request must carry a tenant identity and every piece of state (attempts, portfolio, ledgers, chat transcripts, governor state) must be tenant-scoped.

Requirements

1. GitHub OAuth sign-in for the hosted dashboard producing a server-side session; the session actor is the tenant key. Reuse the existing session/identity machinery and the established access boundary (identity is per-login; session.actor === requestedLogin — the contributor side of the miner⊕maintainer boundary), not a new auth stack.
2. Every hosted API surface the dashboard calls is tenant-scoped server-side: attempts, portfolio state, rental-ledger reads, governor state, chat transcripts. Client-side filtering is not scoping — a tampered client must be unable to read or mutate another tenant's rows.
3. Cross-tenant denial is tested per surface (authenticated-as-A requests B's resources → deny), not per convention.
4. Session lifecycle: expiry/revocation invalidates in-flight work cleanly (align with the streaming-termination semantics established on the ORB side); re-auth resumes without state loss.
5. No PII beyond the GitHub login/id in tenant records; the privacy boundary (no wallet/hotkey/reward/trust-score data) applies to every new row and response shape.

Deliverables

• OAuth + session wiring for hosted mode; tenant-scoping enforcement on every dashboard-consumed surface.
• Tests: per-surface cross-tenant denial, session-lifecycle behavior, response-shape privacy checks.

Expected outcome

A hosted miner-dashboard session is a real tenant boundary, enforced server-side everywhere, ready for the grounding/action layer above it.

[linear-code]

JSO-6356