feat(v4.0): GitHub routes + CSRF exemptions for share/publish

- app/routers/github_routes.py: /api/github/status + disconnect
- CSRF: ajout /api/github, /api/pages, /api/recents aux exclusions
- main.py: registration github_router

app/routers/github_routes.py

@@ -0,0 +1,35 @@
+"""GitHub OAuth — status and disconnect routes."""
+from fastapi import APIRouter, Request
+from fastapi.responses import JSONResponse
+
+router = APIRouter(tags=["github"], prefix="/api/github")
+
+
+@router.get("/status")
+async def github_status(request: Request):
+    """Check if the current user has GitHub linked."""
+    from app.auth.session import SessionManager
+    from app.db import get_conn
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return {"linked": False}
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT github_token FROM user_oauth_tokens WHERE user_id=? AND provider='github' AND github_token IS NOT NULL AND github_token != ''",
+            (user["id"],)
+        ).fetchone()
+    return {"linked": row is not None}
+
+
+@router.delete("/disconnect")
+async def disconnect_github(request: Request):
+    """Remove all GitHub OAuth tokens for the current user."""
+    from app.auth.session import SessionManager
+    from app.db import get_conn
+    user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
+    if not user:
+        return JSONResponse({"error": "Not authenticated"}, status_code=401)
+    with get_conn() as conn:
+        conn.execute("DELETE FROM user_oauth_tokens WHERE user_id=? AND provider='github'", (user["id"],))
+        conn.commit()
+    return {"status": "ok"}