feat(miniapp): add built-in PR review inbox

[limityan]

Summary

• Adds the PR Review Inbox as a built-in MiniApp with GitHub/GitCode-compatible repository watching, direct PR opening, review queue sync, AI draft generation, manual comments, and guarded publish flow.
• Exposes the small host capabilities the MiniApp needs through the MiniApp bridge, including external URL opening, system notifications, host primitive calls, and storage support for node-disabled built-ins.
• Improves MiniApp reseeding with asset-hash detection, keeps user storage/customizations safe, and redacts sensitive token-like values from frontend API logs.
• Polishes the PR Review UI for theme consistency, clearer PR metadata, review progress visibility, clickable file targets, and smoother middle/right-column scrolling.

Validation

• node --check src\crates\core\src\miniapp\builtin\assets\pr-review\ui.js
• cargo test -p bitfun-core builtin
• pnpm run lint:web
• pnpm run type-check:web
• pnpm --dir src/web-ui run test:run
• cargo check --workspace
• cargo test --workspace

Notes

• The branch was rebased onto latest GCWing/BitFun main before opening the PR.
• Sensitive session tokens remain memory-only in the MiniApp and are not persisted or logged.