[codex] Add GitHub-authenticated loop voting

[mberman84]

What changed

• add persistent upvote/downvote storage in a SQLite Durable Object
• require signed GitHub OAuth sessions for vote writes
• keep public vote totals readable and sort featured loops by popularity
• make voting visible but secondary to the primary Copy Loop action
• add the here.now proxy routes, production secret documentation, and regression tests
• remove the unused X OAuth path
• keep voting hidden and disabled until the Worker returns the exact production launch signal

Why

Loop Library needs durable community ranking without letting anonymous or cross-site requests manipulate votes. GitHub-only authentication keeps the first release focused and matches the configured OAuth application. The fail-closed launch gate lets us prove canonical-domain OAuth cookies and proxy behavior before users see voting.

Validation

• node --check site/script.js
• node scripts/check.mjs
• npm --prefix worker run check (46 passing tests)
• JSON validation for the site data, proxy manifest, and SEO benchmark
• git diff --check
• npx wrangler deploy --dry-run
• browser verification with the launch signal missing and explicitly enabled
• autoreview: clean with no actionable findings

Staged launch

1. Merge with VOTING_UI_ENABLED=false.
2. Deploy the Worker first, then publish the site/proxy from the clean deployment checkout under the shared Loop Library lock.
3. While controls remain hidden, verify GitHub start, callback cookies, session persistence, vote persistence, reload, logout, and anonymous rejection on the canonical domain.
4. Change the flag to the exact string true on newest integrated main and redeploy only the Worker.
5. Verify controls appear, Copy Loop remains primary, and both canonical/backing URLs are healthy.