[MergeShip] MVP-1: GitHub OAuth onboarding + contributor profile bootstrap

[Shivampal157]

Context

This is an implementation sub-issue related to C4GT DMP 2026 ticket:

• Parent: [DMP 2026]: MergeShip - Gamified Open Source Orchestration & Mentorship Platform #774

I am taking up MVP-1 so progress can be delivered in small reviewable PRs.

Scope (MVP-1)

• GitHub OAuth login flow
• Contributor profile creation on first login
• Basic profile fields persistence (github_id, username, avatar, joined_at, default_level=L1)
• Protected endpoint to fetch current user profile
• .env.example + setup notes for OAuth variables

Out of Scope (for this issue)

• L1/L2/L3 scoring logic
• Maintainer triage queue
• XP/gamification engine

Deliverables

• Backend OAuth + profile APIs
• Minimal frontend login + profile page wiring
• Setup documentation update
• Basic tests for auth/profile endpoints

Acceptance Criteria

• User can sign in with GitHub successfully
• First login creates contributor profile
• Subsequent login returns existing profile
• Protected profile endpoint works with auth
• Local setup works from docs without manual guesswork

PR Plan

I will open one PR for this issue:

• feat(auth): github oauth onboarding and contributor profile bootstrap

[Shivampal157]

hii @Ayush-Patel-56, I would like to work on this sub-issue as MVP-1 under #774.
If this scope looks good to mentors/maintainers, I will raise the PR

[Shivampal157]

Adding implementation notes for clarity:

• Proposed auth approach: GitHub OAuth callback -> app-issued session/JWT -> protected /me profile endpoint.
• Minimum OAuth scopes: read:user (and user:email only if required).
• Security checks: OAuth state validation, token handling via env vars, and no sensitive token logging.