Beta testers report confusing auth flow — 3 of 5 needed help

## Beta Feedback Summary — Auth Flow

Cohort: 5 beta testers (all developers, varying seniority)
Task: Sign up and connect a repo

### Issues Reported

**User A (senior dev):**
- "The redirect to GitHub felt sudden. I wasn't sure if I was still in VCTRL."
- Completed flow successfully but expressed confusion.

**User B (mid-level dev):**
- Didn't understand the GitHub permissions list.
- Asked: "Why does this app need access to my private repos?"
- VCTRL only needs public repo read access — we should narrow the scope.

**User C (junior dev):**
- Thought the app crashed when redirected to GitHub.
- Sat on the GitHub auth screen for 2 minutes before proceeding.

**User D:** No issues.
**User E:** No issues.

### Action Items
1. Add pre-OAuth context screen explaining WHY GitHub is needed
2. Narrow GitHub OAuth scope to minimum required
3. Add a loading/redirect indicator so users know they're coming back
4. Consider: add email fallback login for users without GitHub

### Priority
High — this is the first interaction users have with the product.