feat(L): Phase 1 — Sleep Mode + install script + GitHub OIDC + AI hours saved

feat(L): Phase 1 — Sleep Mode + install script + GitHub OIDC + AI hours saved

Four sub-blocks shipped together because they cross-cut shared files
(`src/app.tsx` mounts each new router; `src/routes/api-v2.ts` carries new
endpoints; `src/routes/auth.tsx` renders a new sign-in button). Splitting
the diff per block would produce intermediate commits that don't build.
Per-block summaries below.

L1 — SLEEP MODE (marquee marketing feature)
  Toggle that turns the K3 autopilot into a "while-you-slept" personal
  assistant. Daily digest at a user-configured UTC hour, calling out
  PRs auto-merged, issues built from `ai:build` labels, AI reviews,
  secret-scan auto-fixes.
    src/lib/sleep-mode.ts (536 lines, NEW)  — composeSleepModeReport,
        renderSleepModeDigest, sendSleepModeDigestForUser. Re-uses
        src/lib/email-digest.ts's escape + send helpers. Never throws.
    src/routes/sleep-mode.tsx (218 lines, NEW) — public /sleep-mode
        marketing page (hero, three-step, sample digest screenshot).
    src/routes/settings.tsx — adds the Sleep Mode toggle + hour input
        + "Preview digest now" button.
    src/lib/autopilot.ts — adds the `sleep-mode-digest` task. Each tick
        finds users with sleep_mode_enabled=true whose digest hour
        matches the current UTC hour AND who haven't received a digest
        in 23h. Cap 100 users per tick.
    drizzle/0041_sleep_mode.sql — adds users.sleep_mode_enabled
        (bool, default false) + users.sleep_mode_digest_hour_utc
        (int 0-23, default 9). Strictly additive.
    src/__tests__/sleep-mode.test.ts — covers render escapes, zero-
        activity reports, formula determinism, hour-matching gate,
        23h cooldown, public route 200.

L2 — ONE-COMMAND INSTALL SCRIPT
  Removes adoption friction. `curl -sSL gluecron.com/install | bash`
  signs the user in, mints a fresh `glc_` PAT (admin scope), writes a
  Claude Desktop MCP server entry, optionally imports the user's
  current GitHub repo. Idempotent.
    scripts/install.sh (213 lines, NEW, executable) — bash, set -euo
        pipefail; macOS + Linux + WSL; uses git + curl + jq.
    src/routes/install.ts (59 lines, NEW) — GET /install serves the
        script with text/x-shellscript + 5-min CDN cache.
    src/routes/api-v2.ts — adds POST /api/v2/auth/install-token,
        SESSION-COOKIE-ONLY auth (explicit 401 on Bearer to prevent
        token escalation). Audit-logs every mint as
        auth.install_token.created.
    src/__tests__/install.test.ts — 11 tests (9 active + 2 DB-gated
        skip), happy path + Bearer rejection + cache header.

L6 — GITHUB OIDC SIGN-IN
  Reuses the I10 SSO machinery to add "Sign in with GitHub" as a
  built-in option alongside enterprise OIDC. Handles GitHub's
  non-standard OAuth (Accept: application/json on token endpoint, null
  email fallback via /user/emails primary+verified pick, no id_token).
  Subject keyed as `github:${id}` to coexist with enterprise SSO links.
    src/lib/github-oauth.ts (187 lines, NEW) — pure network-only
        helpers. Injectable fetchImpl for tests.
    src/routes/github-oauth.tsx (367 lines, NEW) — /login/github,
        /login/github/callback, /admin/github-oauth config page.
    src/lib/sso.ts — appends getGithubOauthConfig +
        upsertGithubOauthConfig + findOrCreateUserFromGithub +
        githubOauthRedirectUri. Existing findOrCreateUserFromSso
        untouched.
    src/routes/auth.tsx — adds the GitHub button above the existing
        enterprise SSO button on /login.
    drizzle/0042_github_oauth.sql — INSERT seed row id='github' into
        the existing sso_config table. Schema unchanged.
    src/__tests__/github-oauth.test.ts — 22 tests; authorize URL
        params, token exchange shape, userinfo + email fallback edge
        cases, subject-prefix contract, route smokes.

L9 — AI HOURS SAVED COUNTER (retention)
  Dashboard hero widget making the value of AI features VISIBLE every
  time a user logs in. Computes a transparent, conservative formula
  over audit_log + activity tables. Renders large gradient number
  with this-week / all-time tabs + breakdown pills + "How is this
  calculated?" disclosure.
    src/lib/ai-hours-saved.ts (413 lines, NEW) — public formula
        `computeHoursSaved(breakdown)` (pure, deterministic) +
        `computeAiSavingsForUser(userId, opts?)` (DI'd DB queries) +
        `computeLifetimeAiSavingsForUser(userId)`. Worked example
        documented in code.
    src/routes/dashboard.tsx — top-row "AI working for you" widget.
        Big gradient number, week/lifetime tabs, breakdown pills,
        formula disclosure. Exports formatSavingsPills for tests.
    src/routes/api-v2.ts — adds GET /api/v2/me/ai-savings
        (requireApiAuth) so the VS Code extension + CLI consume the
        same metric.
    src/__tests__/ai-hours-saved.test.ts — 17 tests; formula
        examples, zero-activity user, windowing, lifetime, monotonic
        invariant, dashboard route 200.

Full suite: 1415 pass / 0 fail / 2 skip (DB-gated). 109 files. Up from
1350 / 0 / 0 after K-block. +65 new tests across L1+L2+L6+L9.

Follow-ups (none blocking, flagged for §7 IN-FLIGHT in a later doc
commit):
  - L1 and L9 ship near-identical hours-saved formulae; consolidate
    L1 to import computeHoursSaved from src/lib/ai-hours-saved.ts.
  - The L2 install-token endpoint sits under apiAuth's umbrella so
    its explicit Bearer-rejection branch only fires for valid-but-
    wrong-auth-method callers; harmless (still 401) but worth a
    cleaner mount on a sibling router.
  - L9's ai.commit_message.generated event isn't currently emitted
    by any producer; counter returns 0 for that line item until
    src/lib/ai-generators.ts generateCommitMessage gets an audit()
    call.
  - L6's redirect_uri must exactly match what the user registered in
    GitHub Developer Settings; /admin/github-oauth surfaces it with a
    copy button.