apr(wiring): connect createAprRepoForCustomerSession to the idea-submission route

[JSONbored]

Problem

Repo creation is implemented and unreferenced — no route, no caller. An idea submission
currently cannot produce a repo.

Scope

• Route from an authenticated idea submission to createAprRepoForCustomerSession, using
  the submitting session's own OAuth token
• The elevated repo scope is requested only on the explicit idea-submission OAuth flow
  (startGitHubWebOAuth's scope parameter) — the default login flow must remain
  unaffected, per the creation module's header
• Handle the structured failure results the function already returns: missing or expired
  session token, repo-name collision, GitHub API error. Each needs a distinct
  customer-facing outcome, not a generic failure
• Repo naming: derive from the idea, collision-safe, customer-visible before creation
• Write the binding record at creation time (depends on apr(completion): persist completion and repo-binding records (#7664, #9490) #10084)

Acceptance

An authenticated customer can submit an idea and end up with an empty repo under their own
account; every failure mode returns a distinct, actionable result; the default login flow
still requests no elevated scope.

[linear-code]

JSO-7084