docs: clarify required GitHub App permissions and webhook events

[foxted]

Summary

Document GitHub App permissions and webhook subscriptions in README.md so setup is clearer and less error-prone.

Changes

• Add a dedicated GitHub App permissions and webhooks section to README.md.
• Document a practical set of repository permissions based on current apps/web usage:
  • Contents (read/write)
  • Metadata (read)
  • Pull requests (read/write)
  • Issues (read)
  • Checks (read)
  • Actions (read)
  • Administration (read, optional/best-effort)
• Document organization permission requirements (Members: read).
• Document webhook setup:
  • payload URL: /api/github/webhook
  • secret: GITHUB_WEBHOOK_SECRET
  • events: installation, installation_repositories, pull_request
• Link deploy instructions to this section so GitHub App setup is explicit.

Why

The previous README documented env vars and callback URLs, but it did not clearly specify GitHub App permission scopes and webhook subscriptions. This made setup ambiguous and could cause avoidable integration failures.

Note

These permissions were derived by exploring the current codebase and inferring required API access from the GitHub endpoints used. This is a best-effort starting point, not a guaranteed exhaustive or future-proof list.

[vercel]

@foxted is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.

[yamz8]

plans to merge it soon?