Act from /review: Merge, Close, Request changes, Reply, by button or key, then the next item #3258

Part 3 of #3247.

Done looks like:

• [ ] Each /review row has these buttons:

- Merge, through the existing landing gate, never around it - Close - Request changes, with a text box - Reply, with a text box

Each is a plain form POST that works without script, with the same-origin check and CSRF the other mutations use.

• [ ] After an action, the page answers with a 303 back to /review#<next ask>, and the acted item is gone.
• [ ] Keys: j/k move between rows and m/c/r act on the focused row, in a small script under the page's CSP. Keys are ignored while a text box has focus, and they are listed in the page's keyboard help.
• [ ] Nothing is added outside the design system. bun test test/design-lint.test.ts passes before the push.
• [ ] A test in test/review-act.test.ts covers each action on a seeded item: it takes effect (merged through the gate, closed, review recorded, comment posted) and the redirect points at the next item. Merging a pull whose check is red is refused with the gate's sentence.

Files: src/web/studio/review_page.ts, src/http/server.ts, test/review-act.test.ts. Risks: Merge must reuse the landing gate's code path, so a person's merge here is held to the same rules as anywhere.