Cut a wave: an admin opens a draft waves/<next>.md as a pull listing every pull merged since the last wave

Replaces #1508. Its pulls went red only on unrelated shared tests.

Done looks like

[ ] Settings shows Cut a wave to repository admins only, as a same-origin POST. It opens a pull that adds waves/<next>.md, written by writeWave and listing the pulls merged since the last wave's date. The headline and highlights are marked placeholders. No model call is made.
[ ] If an earlier wave does not parse, the cut stops, names that file and writes nothing. A cut with nothing merged since the last wave is refused with a plain reason.
[ ] Tests: the list matches the merged pulls, and refusals are covered for a non-admin, a cross-origin request and a malformed earlier wave. Any new test file goes in GATE.

Files: the Settings action, src/story/ (a small cut module), test/.

Cut a wave: an admin opens a draft waves/<next>.md as a pull listing every pull merged since the last wave #1627