docs: research GitHub App setup for gh-integration-bot

[MKuckert]

For #100 — research only, does not close the issue.

Adds docs/gh-app-research.md: a concrete implementation guide for replacing the gh-integration-bot's personal access token with a dedicated GitHub App.

• App setup: private repo-only app (gh-integration-bot), 4 permissions (Contents read, Issues read+write, Issue comments write, PRs read), no webhook; bot comments then authored as gh-integration-bot [bot] — the skip-check can move from text-marker matching to an author check.
• Auth flow: App JWT (RS256, ≤10 min) → installation token (≤1 h, 5000 req/h) used as GITHUB_TOKEN; minimal working Node example included.
• Scheduling: GitHub Actions schedule: cron recommended — private key stays in repo secrets, no egress config, negligible minutes for an hourly round.
• Migration checklist: ends with revoking the old personal PAT after the first verified [bot]-authored round.

Note: research was drafted by the Librarian subagent (whose runs truncated before writing); the final document was completed in-session from that draft.