Locking GitHub PATs behind Touch ID with 1Password
A macOS setup recipe for routing GitHub authentication through the
1Password CLI instead of the login keychain.
It covers git and JetBrains IDEs against github.com, the gh CLI, and
docker against ghcr.io.