fix(rag): restore private dependency build credentials

[man4ish]

Summary

PR #64 removed the RAG build secret and build arguments based on an incorrect assumption that the current Dockerfile no longer used private dependencies. The backend stage still installs pinned private git+https dependencies (omnibioai-iam-client and omnibioai-usage-client) through a BuildKit github_token mount. The UI stage separately installs private @OmniBioAI packages through its existing GITHUB_TOKEN npm argument.

This forward fix restores only:

• the frontend GITHUB_TOKEN build argument
• the backend github_token BuildKit secret

It does not restore the removed RAGBIO_API_KEY build argument.

Verification

• docker compose config --quiet: passed
• docker compose build rag: passed, full un-targeted multi-stage build
• frontend npm install and production build: passed
• private IAM and usage client clones/builds: passed
• image: omnibioai-studio-rag built successfully

No force-push or history rewrite.