Clean up OAuth docs

[angrypig555]

Replaced "orpheus.gg" with "sinerider.com" in the oauth documentation as there is a non-hack club related website on that domain.

Summary of the problem

In the oauth documentation (docs/oauth/oauth-apps.md) on line 16 there is an example redirect url. This url has an active website on it and is not affiliated with hackclub. It also may be confused with an official hackclub / hackatime domain. Later on in the documentation, sinerider.com is used and this change would make the link look more like an example that should not be used in real code. Leaving the old url there may also be free advertising for that site / company.

Describe your changes

Changed the url on line 16 from orpheus.gg to sinerider.com

(hi from mahad: also took the opportunity to make the oauth guide a bit nicer)

[greptile-apps]

Greptile Summary

This PR updates the OAuth documentation primarily to replace the orpheus.gg example redirect URI with sinerider.com, and takes the opportunity to rewrite several sections for friendlier tone and clarity. A few of the changes introduce new issues that need attention.

• The example.com domain used in the Step 1 and Step 2 authorization flow code blocks was also changed to sinerider.com; example.com is IANA-reserved for documentation use and is the correct choice for illustrative URIs.
• The admin scope restriction bullet was rewritten to say "requires approval from Hack Club HQ," which misrepresents the actual system behaviour (only admin-level users can authorize such apps — no external approval process exists).
• The example API response for /api/v1/authenticated/me was changed from generic placeholders (user@example.com, octocat) to what appear to be a real person's email, Slack UID, and GitHub handle, exposing PII in public documentation (flagged in a prior review thread).

Confidence Score: 4/5

• Documentation-only change that is safe to merge once the admin scope description is corrected and real PII is removed from the example response.
• The admin scope bullet now says the scope "requires approval from Hack Club HQ," which contradicts the bullet immediately above it (only admin+ Hackatime users can attach the scope) and could mislead developers into waiting for an approval process that doesn't exist. The remaining concerns — using a live project domain in flow examples and PII in the sample JSON — don't break anything but should be cleaned up before the docs go live.
• docs/oauth/oauth-apps.md — specifically the admin scope restriction bullet and the example API response object.

Important Files Changed

Filename	Overview
docs/oauth/oauth-apps.md	OAuth documentation rewrite replacing orpheus.gg with sinerider.com; also changed example.com flow examples to use the real sinerider.com domain, replaced a precise admin scope restriction with an inaccurate "approval from HQ" description, removed the client-secret one-time-view warning, and introduced real PII in the example API response.

Sequence Diagram

sequenceDiagram
    participant App as Your App
    participant Browser as User Browser
    participant HT as Hackatime OAuth
    participant API as Hackatime API

    App->>Browser: "Redirect to /oauth/authorize?client_id=...&scope=..."
    Browser->>HT: GET /oauth/authorize
    HT-->>Browser: Show consent screen
    Browser->>HT: User approves
    HT-->>Browser: "Redirect to redirect_uri?code=AUTH_CODE"
    Browser->>App: Callback with code
    App->>HT: POST /oauth/token (code + client_secret)
    HT-->>App: access_token (Bearer)
    App->>API: GET /api/v1/authenticated/me (Authorization: Bearer token)
    API-->>App: User profile JSON

Loading

_{Reviews (3): Last reviewed commit: "Merge branch 'main' into main" | Re-trigger Greptile}

[skyfallwastaken]

Thanks!