Add To Allowlist

Allowlist add payload (provider-aware since #655).

Three accepted shapes:

• GitHub legacy (pre-#655): {github_username} — preserved verbatim so existing admin tooling keeps working without a flag day.
• GitHub canonical: {provider: "github", github_username} — same semantics, but with the discriminator explicit.
• Google: {provider: "google", email} — resolves the user's OIDC sub by looking up an existing users row with auth_provider='google' and matching email (v1 bootstrap UX — pre-OAuth invitation lands in Phase 2).

Pydantic validates github_username shape when present (1–39 chars, alphanumeric + hyphens, no leading/trailing hyphen) so malformed payloads don't spend a GitHub API request (rate-limited to 60/hr unauthenticated). The email field uses the same regex pattern that the rest of the codebase uses for email-string validation (see models/schemas.py:830); switching to pydantic.EmailStr would require pulling in email-validator as a new dependency, which is not warranted for a single field.

Allowlist entry read-model.

#655 added provider / subject_id / subject_label as the canonical fields. The legacy github_user_id / github_username fields are retained on the response for backward compatibility with pre-#655 admin tooling — for provider='google' rows these carry the sentinel values written by add_to_allowlist_entry ("google:<sub>" / email), which existing GitHub-only consumers can ignore via the new provider field.