[P1.7] Don't return upstream GitHub 401s as this API's 401 (forces web-UI logout)

[frankbria]

Severity: high | Category: correctness | Phase: P1.7

Problem

A bad/revoked GitHub PAT maps InvalidTokenError to HTTP 401, and pr_v2 propagates GitHub's status verbatim. The web UI's axios interceptor reacts to any 401 with clearToken(); redirect('/login') — so entering an invalid PAT, or a revoked token, logs the user out of CodeFRAME itself.

Evidence

codeframe/ui/routers/github_integrations_v2.py:205, codeframe/ui/routers/pr_v2.py:306

Acceptance criteria

• Upstream-credential failures map to a distinct code (e.g. 400/502 UPSTREAM_AUTH_FAILED), never raw 401 on authenticated routes.
• Optionally the web UI scopes its logout redirect to a specific auth-expiry code.

Dependencies

None

---

_{Filed from the SaaS launch-readiness audit. Atomic: one developer, one session. Work order: strictly P0.1 → P3.12 (no forward dependencies).}

[coderabbitai]

🔗 Related PRs

#238 - fix(auth): migrate lint API to authenticated axios and harden E2E tests [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!