Stop injecting GitHub OAuth credentials into ord-interface

[skearnes]

Summary

The Flask editor was the only consumer of GH_CLIENT_ID/GH_CLIENT_SECRET, and it is gone from ord-interface as of open-reaction-database/ord-interface#172. This drops the wiring that kept feeding them to the service:

• the github-client Secrets Manager secret,
• its ARN in secret_arns, which is what granted the execution role permission to read it,
• the two TaskDefinitionSecretArgs entries that injected the values into the container.

Already applied to prod

This was deployed before the PR — the running service was still handing GitHub OAuth credentials to an image that no longer has anything to do with them, and that is what "shut off editor access" meant in practice. This PR is the code catching up to the deployed state, so a future pulumi up from a clean checkout doesn't re-create the secret and re-add the injections.

State after the deploy (pulumi up, 7m37s, no errors):

• Task definition service-8b52d386:1, image sha256:0ea4c026…, built from ord-interface main at d5e6981.
• Container secrets are now POSTGRES_PASSWORD and ANTHROPIC_API_KEY only.
• execution_role_secrets policy narrowed to the remaining two ARNs.
• ECS rollout COMPLETED, one task running.
• github-client deleted with the default 30-day recovery window (restorable until ~2026-09-03).

Test plan

• pulumi preview showed exactly the four intended changes and nothing else
• pulumi up succeeded; rollout reached COMPLETED with one healthy task
• aws ecs describe-task-definition on the live task lists only POSTGRES_PASSWORD and ANTHROPIC_API_KEY
• open-reaction-database.org — /, /browse, /search, /about, /api/datasets all 200
• /editor, /editor/, /editor/foo, /editor/healthcheck all 301 to https://app.open-reaction-database.org/; /editorx still falls through to the SPA
• pre-commit (addlicense, ruff check, ruff format, ty) clean

Follow-up

The GitHub OAuth app behind those credentials still exists and should be deleted from the org's developer settings; that can't be done from here.

🤖 Generated with Claude Code

Greptile Summary

This PR aligns the interface stack with the already-deployed production state by removing obsolete GitHub OAuth credentials.

• Deletes the github-client Secrets Manager resource.
• Removes its ARN from the ECS execution role’s permitted secrets.
• Stops injecting GH_CLIENT_ID and GH_CLIENT_SECRET into the interface container.

Confidence Score: 5/5

The PR appears safe to merge, with no actionable defects identified in the credential-removal path.

The removed secret and environment variables have no remaining repository consumers, and the change consistently removes resource creation, execution-role access, and container injection.

Important Files Changed

Filename	Overview
stacks/interface/main.py	Cleanly removes the unused GitHub OAuth secret resource, IAM access, and ECS secret injections without leaving repository consumers behind.

_{Reviews (1): Last reviewed commit: "Stop injecting GitHub OAuth credentials ..." | Re-trigger Greptile}