feat(compose): add optional GitHub sync service

[YannJY02]

Summary

• bundle the GitHub synchronization service behind the opt-in github Compose profile
• configure the front end and webhook proxy without requiring manual Compose or nginx edits
• use the internal collaborator endpoint and avoid publishing the GitHub service port
• separate GitHub App variables from the existing GitHub OAuth variables
• preserve the optional settings when generating huly_v7.conf
• document the issue_comment subscription required for issue and pull request comments

Default deployments remain unchanged: the service is disabled until COMPOSE_PROFILES=github is configured, and nginx resolves the optional service only when a request reaches the GitHub route.

Validation

• bash -n setup.sh
• sh -n setup.sh
• git diff --check
• validated both default and github profile service lists with docker compose config --services
• asserted the rendered service uses ws://collaborator:3078, Redpanda, and no host port
• started and validated nginx without a github DNS target to verify the default profile remains available
• verified multiline GitHub App private keys survive config generation

No credentials, private deployment URLs, or generated local configuration are included.

Refs #179, #296, #297. Related to #300.