feat: link QA test cases to GitHub issues

File a GitHub issue from a failing test case, and let the case follow the
issue afterwards.

  POST   api/testcasemanagement/v1/testcase/{id}/issue   file + link
  DELETE api/testcasemanagement/v1/testcase/{id}/issue   unlink
  POST   api/testcasemanagement/v1/issues/sync           reconcile now

plus TestCaseIssueReconciler, a background sweep on the same code path as the
manual endpoint so the two cannot drift. Admin-gated: these are not part of the
2023 client's surface, unlike the existing test-case routes which are open
because the watch gates that tab client-side.

The link lives in TestCaseEntity.JiraBugUrl — the field Rec Room's own tooling
used for the bug filed against a failing case. That avoids a migration, which
matters more here than the name: the Postgres path is EnsureCreated-only and
never replays migrations, so a new column has to be added twice or it is missing
in production. A leftover genuine Jira link is ignored rather than misparsed,
since the issue number is only read from a GitHub-shaped URL.

Filing is idempotent — a case already carrying a live issue returns it instead
of filing again, so sweeping a failing pass repeatedly does not spam duplicates.
Unlinking leaves the issue alone; closing someone's issue as a side effect of
tidying a QA link would be the wrong call.

Reconcile moves a case only between the two states it owns: closed+Failed goes
to NotYetTested, open+NotYetTested goes back to Failed. A closed issue is NOT
marked Passed — closing is a developer's claim that the fix landed, not a
tester's observation that the case passes, so the case goes back in the queue.
The first draft flipped any non-Failed case to Failed on an open issue, which
contradicted its own doc comment and yanked a case out from under a tester
mid-claim; the test for that caught it.

Everything degrades rather than fails when unconfigured: IsConfigured is false
without a token, endpoints answer 503 with the reason, and the reconciler logs
once and idles. GitHub is faked in the tests, which cover idempotency, both
state transitions, the mid-claim case, and the unconfigured path.

DorkNet.Server/Startup/ServiceCollectionExtensions.cs

@@ -210,6 +210,13 @@ public static class ServiceCollectionExtensions
         services.AddSingleton<RoomBlobNormalizerService>();
         services.AddHttpClient();
         services.AddSingleton<HtrAssetMirrorService>();
+        // QA test cases ↔ GitHub issues. Singleton because it holds only
+        // configuration; the reconciler makes its own scope for the DbContext.
+        // Both are registered unconditionally — the service reports
+        // IsConfigured=false without a token and the reconciler then idles,
+        // so a deployment with no GitHub credentials behaves normally.
+        services.AddSingleton<IGitHubIssues, GitHubIssueService>();
+        services.AddHostedService<TestCaseIssueReconciler>();
         // Scoped (per-request) — these services hold DbContext references and
         // must share the request's scope to participate in the request's
         // transaction lifecycle. Pre-PR-3 they were Singleton with in-process