Token reassembly from `claude setup-token` can splice in non-token text and write garbage to CLAUDE_CODE_OAUTH_TOKEN

• dashboard/app/api/auth/route.ts:81-108

The first-line push is `tokenChars.push(trimmed)` without filtering — `trimmed` is the entire first line starting at `sk-ant-oat`, which in real `claude setup-token` output is wrapped inside an ANSI/box-drawing TUI and often contains trailing spaces, box characters, or ANSI escape sequences. Because no regex is applied to the first line, ANSI escape bytes and box-drawing glyphs get concatenated into `token`. The resulting `token` is then written to the GitHub secret as the OAuth token, silently corrupting auth. Worse, since `output.indexOf('sk-ant-oat')` only checks existence, even unrelated occurrences (e.g. inside a help string) get accepted. The handler then returns `ok: true` despite the bogus value.