fix: repair private repository access from the edit page (#892)

* fix: repair private repository access from the edit page

* fix: respect App rollout and reload renamed sources after repair

* fix: gate access repair by status and update response tests

docs/github-app-setup.md

@@ -108,6 +108,14 @@ Public reads use a [repository-scoped App user token](https://docs.github.com/en
 Each API request renews through its own repository binding, rechecking identity
 and public visibility while keeping the same user quota.
 Existing installation bindings retain their installation checks.
+
+If a previously public source becomes private, its existing public-only binding
+continues to reject private reads. Select the repository in the App installation,
+then open the anonymization's Edit page and click **Repair GitHub access**. This
+verifies installation access to the same GitHub repository ID and published commit
+before replacing the binding. It preserves the anonymous URL, snapshot and settings.
+Signing in again alone does not change a resource's binding. The Connections page
+also provides **Reconnect read-only access** for this purpose.
 This uses GitHub's documented [public resource access for App user tokens](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/choosing-permissions-for-a-github-app).
 
 The explicit **Use existing OAuth access** choice handles repositories not yet