Complete HttpClient consolidation: migrate remaining 4 sites, fix thread-safety

[mock1ngbb]

PR #5 claimed 9 sites converted but only 5 were done. 4 sites in App.axaml.cs still use ad-hoc new HttpClient() with inline auth.

1. Audit remaining new HttpClient() calls: grep -rn 'new HttpClient'
2. Replace with HttpClientFactory.GetGitHubClient()
3. Fix thread-safety: concurrent auth header writes from GetGitHubClient() race — use a separate pre-configured client per auth scope or clone headers
4. Remove dead settings.GitHubApiToken auth header code from call sites

Files: App.axaml.cs (lines 255, 299, 337, 788 verified)

AXIOM 5 (Defer nothing): incomplete work was merged — finish it.