docs: clarify required GitHub App permissions and webhook events

Summary

Document GitHub App permissions and webhook subscriptions in README.md so setup is clearer and less error-prone.

Changes

• Add a dedicated GitHub App permissions and webhooks section to README.md.
• Document a practical set of repository permissions based on current apps/web usage:
  • Contents (read/write)
  • Metadata (read)
  • Pull requests (read/write)
  • Issues (read)
  • Checks (read)
  • Actions (read)
  • Administration (read, optional/best-effort)
• Document organization permission requirements (Members: read).
• Document webhook setup:
  • payload URL: /api/github/webhook
  • secret: GITHUB_WEBHOOK_SECRET
  • events: installation, installation_repositories, pull_request
• Link deploy instructions to this section so GitHub App setup is explicit.

Why

The previous README documented env vars and callback URLs, but it did not clearly specify GitHub App permission scopes and webhook subscriptions. This made setup ambiguous and could cause avoidable integration failures.

NOTE

These permissions were derived by exploring the current codebase and inferring required API access from the GitHub endpoints used. This is a best-effort starting point, not a guaranteed exhaustive or future-proof list.