Terraform GitHub App scopes down to alunduil-infrastructure only, drops Administration write

## Summary

Reinstall the Terraform GitHub App on `alunduil/alunduil-infrastructure` only (currently installed on "All repositories" in the account) and drop `Administration: Read and write` from its permissions if `terraform/modules/github_repository` doesn't need it. Today a leaked App key gets push access to every repo in the account, including `alunduil-chezmoi`.

## Motivation

`docs/how-to/create-github-app.md` directs:

- Install scope: "All repositories"
- Permissions: `Administration: RW`, `Contents: RW`, `Pages: RW`, `Metadata: R`

The App's private key lives in GitHub Actions secrets as `GH_APP_PRIVATE_KEY` and is readable by the plan workflow on every PR (including Renovate's). The realistic leak vector is workflow injection — compromised pre-commit hook, compromised Action / Terraform provider, etc. With "All repositories" install, an attacker who lifts the key gets `Contents: RW` on **alunduil-chezmoi** alongside this repo, which is a workstation-compromise path: the next `chezmoi apply` pulls attacker code (incl. age-decrypted secrets) onto the workstation.

Scoping the install to just this repo matches the App's actual use (the `terraform github` provider managing the repos enumerated in `terraform/alunduil/repositories.tf`, all of which it can still reach via collaborator/owner permissions on individual repos when they're added back to scope as needed). `Administration: RW` is broader than `Contents` / `Pages` and worth pruning if the module doesn't need it.

## Scope

- Skim `terraform/modules/github_repository/main.tf` and confirm which fields actually require `Administration: RW` (likely just `vulnerability_alerts` / `archived` / branch protection — `terraform_github_branch_protection` is not currently used here, so Administration may be droppable). Verify against the `integrations/github` provider docs.
- Reinstall the App on **selected repositories**: `alunduil/alunduil-infrastructure` (and whatever other repos the provider needs to manage — the repos in `repositories.tf` are managed *by* this App, so add them all explicitly rather than wildcard).
- Drop `Administration: RW` if confirmed unneeded.
- Update `docs/how-to/create-github-app.md` to match the new scope + permission set.

## Acceptance criteria

- [ ] App install is "Only selected repositories" with `alunduil-chezmoi` not in the list
- [ ] `terraform/modules/github_repository` apply still succeeds end-to-end via CI
- [ ] `docs/how-to/create-github-app.md` reflects the actual permission and install scope
- [ ] If `Administration: RW` is dropped, that's reflected in the doc too

## Additional context

Origin: #77 / PR #79 threat-model follow-up. The App is set up in #61 and consumed in #63.