fix(types): validate auth token responses

[open-inspect]

This is an automated nightly unsafe-cast remediation. It replaces selected high-risk TypeScript assertions at OAuth/API trust boundaries with Zod safeParse validation, following the TypeScript Coding Standards unsafe-cast / parse-don't-assert guidance and the Zod boundary-validation pattern established in PR #807.

Finding	Risk	Cast removed	Fix
packages/control-plane/src/auth/github.ts:48	HIGH	(await response.json()) as GitHubTokenResponse & { error?: string; error_description?: string } for GitHub OAuth code exchange	Added githubTokenResponseSchema as the GitHubTokenResponse source of truth and parse through parseGitHubTokenResponse with preserved OAuth error handling
packages/control-plane/src/auth/github.ts:81	HIGH	(await response.json()) as GitHubTokenResponse & { error?: string; error_description?: string } for GitHub OAuth refresh	Reused githubTokenResponseSchema.safeParse at the refresh boundary
packages/control-plane/src/auth/openai.ts:50	HIGH	response.json() as Promise<OpenAITokenResponse> for OpenAI OAuth refresh	Replaced the hand-written interface with openAITokenResponseSchema / z.infer and validate the parsed response before returning

Verification:

Command	Result
npm test -w @open-inspect/control-plane -- src/auth/github.test.ts src/auth/openai.test.ts	Passed
npm run build -w @open-inspect/shared	Passed
npm run build -w @open-inspect/control-plane	Passed
npm run typecheck	Passed
npm run lint	Passed after temporarily moving the pre-existing untracked .opencode/ tooling directory out of the workspace so the root lint command evaluated tracked repository files
npm run format	Passed
npm test -w @open-inspect/control-plane	Passed

---

Created with Open-Inspect

[github-actions]

Terraform Validation Results

Step	Status
Format	✅
Init	✅
Validate	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @open-inspect[bot], Action: pull_request