fix: support gists through GitHub App login (#875)

* fix: prompt OAuth reconnection when gist credentials are rejected

* fix: support gist reads through GitHub App user grants

* test: adapt truncated gist regression to provider selection

* fix: address gist reconnect visibility and token renewal review

* fix: verify App authorization before revoking OAuth

docs/github-app-migration-plan.md

@@ -52,7 +52,7 @@ Request no repository write permissions. Verify PR issue-comment reads with the
 
 Pages lookup specifically requires Pages read; lack of Pages access must not make ordinary repository import fail. See [Pages endpoint permissions](https://docs.github.com/en/rest/pages/pages#get-a-github-pages-site).
 
-Gists are a separate capability. Keep existing gist resources on OAuth in the first release, and show that requirement for App-only users. Do not send installation tokens to gist endpoints. Evaluate App user-token support for gist content, comments and raw downloads as a later compatibility step using the [gist API reference](https://docs.github.com/en/rest/gists/gists). OAuth retirement depends on resolving this gap.
+Gists use App user tokens when available, with refresh and provider-specific reconnect handling. Do not send installation tokens to gist endpoints. Reading gist content and comments requires no additional App permissions; see the [gist API reference](https://docs.github.com/en/rest/gists/gists). Accounts without an App connection retain OAuth access.
 
 ### Persistence and credential lifecycle
 
@@ -93,7 +93,7 @@ Keep rate-limit behavior across token renewal by using provider-aware quota iden
 4. Provide a migration preview listing eligible resources and blocked resources, with reasons such as repository not selected, approval pending, missing permission or gist compatibility.
 5. On explicit migration, verify App access and read the resource's configured commit (or PR) before conditionally updating its binding. Preserve all anonymization settings, URLs and caches. A partial batch reports per-resource results and can be rerun; jobs read the latest binding and reject stale results if the binding changes while running.
 6. Display each resource's connection and reconnect action. Connecting the App alone does not migrate resources or revoke OAuth.
-7. Offer OAuth disconnect after listing remaining dependencies, including gists. A new sign-in does not reduce an existing OAuth grant's scope. Complete removal of the broad grant requires explicit revocation; warn about affected resources in that concrete disconnect flow.
+7. Offer OAuth disconnect after listing remaining repository and pull-request dependencies. Gists use the App user connection automatically. A new sign-in does not reduce an existing OAuth grant's scope. Complete removal of the broad grant requires explicit revocation; warn about affected resources in that concrete disconnect flow.
 
 ## Revocation, webhooks and retained content
 

docs/github-app-setup.md

@@ -108,11 +108,10 @@ Existing installation bindings retain their installation checks.
 This uses GitHub's documented [public resource access for App user tokens](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/choosing-permissions-for-a-github-app).
 
 The explicit **Use existing OAuth access** choice handles repositories not yet
-available through the App. An App error never silently selects OAuth. Gists
-continue using OAuth. An App-only user entering a gist URL is prompted to connect
-OAuth, with the current repository permission scope explained. The form draft
-is saved for 30 minutes and restored after authorization. Users with an existing
-OAuth connection can use it immediately. OAuth remains available on the
+available through the App. An App error never silently selects OAuth. Gists prefer
+an existing App user grant and otherwise retain legacy OAuth access. Rejected
+credentials prompt reconnection to the same provider. The form draft is saved for
+30 minutes and restored after authorization. OAuth remains available on the
 Connections page, separate from sign-in.
 
 **GitHub connections** lists each resource's current connection. First check
@@ -121,8 +120,12 @@ commit or PR and conditionally updates the binding; it preserves the anonymous
 URL, settings and existing content. Busy resources must finish before switching.
 Each resource can be switched back to a verified existing OAuth grant.
 
-OAuth can be explicitly revoked once all dependent resources, including gists,
-have been migrated or removed and a working App sign-in remains. Merely connecting
+Gists use the App user token when an App connection exists, including token refresh.
+Reading gist content and comments needs no additional GitHub App permissions or
+repository installation. Legacy OAuth remains available for accounts without an App connection.
+
+OAuth can be explicitly revoked once dependent repositories and pull requests
+have been migrated or removed and a working App sign-in remains. Gists do not block revocation. Merely connecting
 the App does not revoke or narrow the OAuth grant.
 
 ## Access lifecycle and rollback