feat: add webhook handler for worlddriven-migrate app (#329)

Implement the backend support for a separate GitHub App that handles
repository transfers to the worlddriven organization.

Changes:
- Add /api/webhooks/migrate endpoint for the migrate app
- Add migrationHandler.js with transfer logic:
  - findApprovedMigrationPR: checks for approved PRs in documentation repo
  - transferRepository: calls GitHub transfer API
  - triggerPRChecks: re-runs CI after successful transfer
- Add getInstallationAccessToken to githubApp.js for multi-app support
- Update .env-example with migrate app credentials

The migrate app uses a separate minimal permission set (administration
only) to enable transfers without requiring elevated permissions on
the main worlddriven app.

Flow:
1. User installs worlddriven-migrate app on their repo
2. Webhook triggers, checks for approved migration PR
3. If approved, transfers repo to worlddriven org
4. Comments on PR and triggers CI re-run

Relates to worlddriven/documentation#23

Author: TooAngel

.env-example

@@ -1,3 +1,14 @@
 export GITHUB_CLIENT_ID=
 export GITHUB_CLIENT_SECRET=
-export SESSION_SECRET=
+export SESSION_SECRET=
+
+# Main worlddriven GitHub App
+export GITHUB_APP_ID=
+export GITHUB_APP_PRIVATE_KEY=
+
+# Worlddriven Migrate GitHub App (for repository transfers)
+export MIGRATE_APP_ID=
+export MIGRATE_APP_PRIVATE_KEY=
+
+# Token for worlddrivenbot user (used for documentation repo operations)
+export WORLDDRIVEN_GITHUB_TOKEN=

src/helpers/githubApp.js

@@ -22,6 +22,33 @@ export async function getInstallationOctokit(installationId) {
   });
 }
 
+/**
+ * Get installation access token for a specific GitHub App
+ * Used for apps other than the main worlddriven app (e.g., migrate app)
+ * @param {number} installationId - Installation ID
+ * @param {string} appId - GitHub App ID
+ * @param {string} privateKey - GitHub App private key
+ * @returns {string} Installation access token
+ */
+export async function getInstallationAccessToken(
+  installationId,
+  appId,
+  privateKey
+) {
+  if (!appId || !privateKey) {
+    throw new Error('App ID and private key are required');
+  }
+
+  const auth = createAppAuth({
+    appId,
+    privateKey,
+    installationId: parseInt(installationId),
+  });
+
+  const { token } = await auth({ type: 'installation' });
+  return token;
+}
+
 // GitHub App API functions
 export async function getPullRequestsApp(installationId, owner, repo) {
   const octokit = await getInstallationOctokit(installationId);