fix: use user token for friends leaderboard

[GhanshyamJha05]

Summary

Fixes #889.

The Friends leaderboard failed for users who did not have a personal GitHub App installation. This includes users who signed in through an organization-level installation, where github_installations.user_id is null.

Root cause

When no user-specific installation was found, getFollowedHandles fell back to getAppOctokit(). That client authenticates with a GitHub App JWT, which cannot call GET /users/{username}/following. The request returned 401, the error was swallowed, and the leaderboard silently displayed only the current user.

Changes

• Read the signed-in GitHub OAuth provider token from the Supabase session.
• Use getUserOctokit(providerToken) when no personal installation exists.
• Keep installation-token authentication for users with a personal installation.
• Avoid making an invalid App-JWT request when no user token is available.
• Add regression coverage for organization-install users.

Validation

• Typecheck: passed
• Lint: passed
• Format check: passed
• Focused Vitest run: blocked by the local Windows sandbox with an esbuild access-denied error while loading vitest.config.ts; no test assertion failure occurred.

[GhanshyamJha05]

@Ayush4958 review

[Ayush4958]

Fix Relying on session.provider_token is a short term patch. Supabase does not persist the OAuth token indefinitely; it disappears when the session refreshes.

When that happens, the friends leaderboard will silently break again for org install users until they log out and back in.

Long term, this feature requires a UI error prompting the user to install the app on their personal account.

[Ayush4958]

Performance Regression Fetching sb.auth.getSession() at the top of getLeaderboard forces a network/database round trip on every single request before the cache is checked. This entirely defeats the caching mechanism for high traffic public leaderboards which adds massive latency.

Fix: Move userAccessToken retrieval into the cache miss branch, exclusively for when scope === 'friends'

[Ayush4958]

Long term, this feature requires a UI error prompting the user to install the app on their personal account.

@jakharmonika364 @Ayush-Patel-56
Take a look at this

[Ayush4958]

Hi @GhanshyamJha05 sry for this but
Instead of hacking around the missing installation with a transient token, we should address the actual problem. If a user doesn't have a personal installation, the UI should explicitly block the Friends Leaderboard and show a clear call-to-action: "You need a personal GitHub App installation to view the Friends Leaderboard. [Click here to install].

[Ayush4958]

I will suggest you to open a new PR with the fix
I mentioned, I will be closing this one