Restore OGM repo dashboard operations

[ewlarson]

Summary

Restores the OGM repo dashboard operating path across deployment, indexing, filtering, and repo discovery.

• Reinstates Kamal cron wiring for the nightly OGM workflow and documents the production secret/env expectations.
• Carries OGM repository identity through legacy import tags, OGM harvest state indexing, and ogm_repo search filters.
• Handles rejected GitHub tokens in repo discovery by warning once and retrying public API requests without authentication.
• Keeps the OGM-owned deployment/sync paths protected after backend sync work.

Impact

This should make the OGM repo dashboard and nightly repo operations usable again after the backend sync, while keeping indexed repo filters tied to current OGM harvest state instead of stale admin tags.

Testing

• ruff check app tests scripts
• ruff format --check app tests scripts
• BTAA_SKIP_TEST_DB=1 python -m pytest tests/elasticsearch/test_index.py tests/services/test_ogm_importer_normalization.py tests/services/test_ogm_repo_filter_parsing.py tests/scripts/test_ogm_importer.py tests/scripts/test_populate_ogm_repos.py tests/scripts/test_render_cron_env.py tests/test_kamal_deploy_config.py (20 passed, 1 skipped)

Note: a normal local pytest run was blocked because the main compose ParadeDB on localhost:2345 is not currently healthy in this checkout, so the focused run used the repository's DB-skip path for unit/mocked coverage.