feat(projects): PR + CI/checks status chip via gh (W3)

Per-project chip: PR state · N checks passing · mergeable — glance from the phone,
re-engage only when it's red, instead of dropping into a terminal for `gh pr checks`.

- src/http/gh.ts (new): single `gh pr view --json number,state,title,url,isDraft,
  mergeable,headRefName,baseRefName,statusCheckRollup` (execFile, no shell, cwd =
  isValidGitDir repo, timeout + maxBuffer). summarizeChecks rolls the mixed
  CheckRun/StatusContext rollup into {total,passing,failing,pending}. Never throws —
  degrades to not-installed (ENOENT) / unauthenticated / no-pr / error / disabled.
  Cache keyed by repoPath+branch (reuses projectScanTtlMs) with in-flight dedupe.
- src/types.ts: additive PrStatus/PrAvailability/PrCheckSummary; config GH_ENABLED
  (default on) + GH_TIMEOUT_MS (8s).
- GET /projects/pr?path= (read-only, isValidGitDir); public/gh-chip.ts render-only
  chip mounted in the project detail header (git repos only).

Read-only, host's own authed gh (same trust as the shell). No untrusted argv (only
the validated cwd); gh stdout/token never logged; the attacker-controllable PR title
is rendered inert via textContent (SEC-H4). Verified: typecheck + build:web clean,
1816 pass (gh tests 118). The 1 red is the known real-PTY ring-buffer timeout flake.

test/worktree-form.test.ts

@@ -35,6 +35,11 @@ const mockTimelineHandle = { dispose: vi.fn() }
 const mockMountTimeline = vi.fn(() => mockTimelineHandle)
 vi.mock('../public/timeline.js', () => ({ mountTimeline: mockMountTimeline }))
 
+// ── Stub PR-status chip (W3) — renderProjectDetail mounts it for git repos ──────
+const mockPrChipHandle = { destroy: vi.fn() }
+const mockMountPrChip = vi.fn(() => mockPrChipHandle)
+vi.mock('../public/gh-chip.js', () => ({ mountPrChip: mockMountPrChip }))
+
 // ── Import AFTER mocks ─────────────────────────────────────────────────────────
 const { validateBranchNameClient, renderNewWorktreeForm, renderProjectDetail } =
   await import('../public/projects.js')