fix: support gists through GitHub App login (#875)

* fix: prompt OAuth reconnection when gist credentials are rejected

* fix: support gist reads through GitHub App user grants

* test: adapt truncated gist regression to provider selection

* fix: address gist reconnect visibility and token renewal review

* fix: verify App authorization before revoking OAuth

docs/github-app-setup.md

@@ -108,11 +108,10 @@ Existing installation bindings retain their installation checks.
 This uses GitHub's documented [public resource access for App user tokens](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/choosing-permissions-for-a-github-app).
 
 The explicit **Use existing OAuth access** choice handles repositories not yet
-available through the App. An App error never silently selects OAuth. Gists
-continue using OAuth. An App-only user entering a gist URL is prompted to connect
-OAuth, with the current repository permission scope explained. The form draft
-is saved for 30 minutes and restored after authorization. Users with an existing
-OAuth connection can use it immediately. OAuth remains available on the
+available through the App. An App error never silently selects OAuth. Gists prefer
+an existing App user grant and otherwise retain legacy OAuth access. Rejected
+credentials prompt reconnection to the same provider. The form draft is saved for
+30 minutes and restored after authorization. OAuth remains available on the
 Connections page, separate from sign-in.
 
 **GitHub connections** lists each resource's current connection. First check
@@ -121,8 +120,12 @@ commit or PR and conditionally updates the binding; it preserves the anonymous
 URL, settings and existing content. Busy resources must finish before switching.
 Each resource can be switched back to a verified existing OAuth grant.
 
-OAuth can be explicitly revoked once all dependent resources, including gists,
-have been migrated or removed and a working App sign-in remains. Merely connecting
+Gists use the App user token when an App connection exists, including token refresh.
+Reading gist content and comments needs no additional GitHub App permissions or
+repository installation. Legacy OAuth remains available for accounts without an App connection.
+
+OAuth can be explicitly revoked once dependent repositories and pull requests
+have been migrated or removed and a working App sign-in remains. Gists do not block revocation. Merely connecting
 the App does not revoke or narrow the OAuth grant.
 
 ## Access lifecycle and rollback