#14 Security: non-members can submit PR approvals on visible repos

From secscan triage. Severity: MEDIUM. CWE-862.

Source: authenticated review submission routes only require repo visibility, not repo reviewer/writer/admin membership (src/server.lisp:2211-2241, src/server.lisp:2515-2536).

Sink: compute-merge-eligibility counts approval reviews without checking that the reviewer is currently authorized to review that repository (src/model.lisp:1560-1603).

Impact: any logged-in user can approve or request changes on any public repository. Those approvals can satisfy required_approvals, so merge policy for public repos can be influenced by non-collaborators.

Exploit sketch: as an authenticated user with no membership on a public repo, POST {"state":"approve"} to /api/v1/repos/OWNER/REPO/pulls/NUMBER/reviews. The review is created and later counted by merge eligibility.

Recommendation: require an appropriate repo role, such as reviewer/writer/admin, for both HTML and API review submission. Also make compute-merge-eligibility count only reviews from users currently authorized to review, so stale permissions do not continue to satisfy policy.

Note: triage candidate requiring human review; source verified, PoC not executed.