perf(git): filter managed identity connection reads (#17563)

Apply the existing exact GitHub source marker predicate in the company-scoped connection query. Keep the JavaScript guard and every current install, grant, consent, identity, and credential check unchanged.

Validation: 74 focused tests, full build and typecheck, exact-head Greptile 5/5 (medium), full green CI, and no unresolved threads. Both marker locations, malformed JSON types, changed/disabled connections, and retained unrelated configuration are covered. The unfiltered counterfactual fails both row-count regressions.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/services/git-credentials.ts

@@ -10,7 +10,7 @@ import {
   userSecretDefinitions,
   type Db,
 } from "@paperclipai/db";
-import { and, eq, inArray, or } from "drizzle-orm";
+import { and, eq, inArray, or, sql } from "drizzle-orm";
 import { isGitHubDotCom } from "./github-fetch.js";
 import { secretService } from "./secrets.js";
 import { toolAccessService } from "./tool-access.js";
@@ -324,6 +324,10 @@ export async function resolveManagedGitHubIdentitySelection(
 }> {
   const connections = await db.select().from(toolConnections).where(and(
     eq(toolConnections.companyId, companyId),
+    or(
+      sql`${toolConnections.config}->'sourceTemplateKey' = '"github"'::jsonb`,
+      sql`${toolConnections.transportConfig}->'sourceTemplateKey' = '"github"'::jsonb`,
+    ),
   ));
   const githubConnections = connections.filter((connection) => {
     const config = connection.config && typeof connection.config === "object" ? connection.config as Record<string, unknown> : {};