Bind a GitHub installation to the organization (owner/admin)

Verifies the sealed state, fetches the installation from GitHub with the App credential, and binds it to this org. Each state is single-use: it is spent on the first installation_id it is presented with (a retry of the same org + installation is idempotent). Every refusal after the state checks out answers the same 404 installation_not_found — an unknown installation, another GitHub App's, one that is or ever was bound to another Mnemom org (a disconnect leaves the GitHub installation live, so it never moves by id; uninstall on GitHub and install afresh), a NEW binding for an installation created before this flow's state was minted, or a state already spent on a different installation. Install the App from the install_url this flow returned. When the API runs with GITHUB_INSTALL_OAUTH_REQUIRED=true, the body must also carry the install-time OAuth code (the App requests user authorization during installation; the setup redirect forwards it): it is exchanged for a user-to-server token and the installation must appear in that user's GET /user/installations. A missing code or a failed check is the same 404 installation_not_found; with the flag on but the App client credentials unset the route answers 503 github_app_unconfigured.