Migrate: say when a GitHub token sees public repos only (private ones don't list), let the token be replaced in place, and give the filter a button #7516

The owner, 2026-10-27, trying to move a private GitHub repo off GitHub and Vercel: "i dont see any private repos… when i press the filter button nothing happens either".

Measured: the Trevato @ github.com origin lists 62 repositories on /migrate, and none is private. The connected token can only see public repos (a classic PAT without repo, or a fine-grained token limited to public repos), and nothing on the page says so. The person thinks the forge is broken.

Done when:

1. When an origin is connected and on its card, the forge reads what the token can see:

- Classic tokens: X-OAuth-Scopes on /user. - Fine-grained tokens: whether /user/repos?visibility=private&per_page=1 answers rows, or GET /user plus a probe of /user/repos?visibility=private. - The card shows one plain line: "This token sees public repositories only, so private ones won't appear", with "Replace the token". That link goes to GitHub's new-token page with the scopes prefilled (https://github.com/settings/tokens/new?scopes=repo&description=forge-migrate), plus a one-line note for fine-grained tokens: "Repository access: All repositories; Contents: Read".

1. Replacing the token keeps the origin and re-lists in place. Today the only path is Disconnect, then connect again.
2. On /migrate, the filter field works:

- Typing narrows the rows live (migrateJs). - Enter filters on the server. - A visible "Filter" button submits the search form for people who expect one, on phones too. - Test: a Playwright-style DOM test that typing ESPO hides the other rows.

1. Tests: a fake GitHub that answers classic scopes public_repo shows the public-only line; one with repo doesn't.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.