Start a GitHub identity link

The sole entry point for starting a GitHub identity link (issue #325), mirroring /oauth/google/link exactly. The SPA submits, as a top-level form POST (never a GET query string), the link_ticket returned by POST /api/v1/me/identities/github.

Validates the ticket read-only (no redemption yet — that happens at /oauth/github/callback). A malformed, wrong-length, unknown, expired, already-consumed, or wrong-provider (e.g. a Google-minted ticket) ticket clears any stale oauth_github_link cookie and redirects straight to {FRONTEND_URL}/settings?link_error=link_invalid without contacting GitHub. A valid ticket sets an oauth_github_link cookie (Path=/oauth/github, 10 minutes) and redirects to GitHub's authorization page exactly like /oauth/github/login.