feat(review): expose self-tune override admin operations (sanitizeOverridePayload/deleteLiveOverride/listOverrideAudit) via a real route

[JSONbored]

Context

src/review/auto-apply.ts:88,198,253 fully implements and unit-tests sanitizeOverridePayload, deleteLiveOverride, and listOverrideAudit — payload validation, a D1 delete, and an audit-history read. Unlike their siblings writeLiveOverride/writeShadowOverride/recordOverrideAudit (called by runAutoApplyRecommendations later in the same file), none of these three appears anywhere else in src/**. No route in src/api/routes.ts exposes override management at all. A self-host operator running the LOOPOVER_REVIEW_SELFTUNE loop has no way to inspect the override audit trail or clear a live override — only the cron's automatic promote path can ever write one.

Requirements

• Add operator-facing routes to src/api/routes.ts (e.g. GET /v1/repos/:owner/:repo/selftune/overrides/audit, DELETE /v1/repos/:owner/:repo/selftune/overrides/:id — follow this repo's existing REST path/verb conventions for similar operator-management routes rather than inventing a new shape) backed by listOverrideAudit/deleteLiveOverride/sanitizeOverridePayload.
• Apply the same auth/access-control convention this repo's other operator-only routes already use (check a comparable existing route, e.g. the gate-precision or agent-settings routes, for the pattern).
• Do not change writeLiveOverride/writeShadowOverride/recordOverrideAudit or the automatic promote path — this issue is scoped to adding the missing operator-facing read/delete surface.

Test Coverage Requirements

99%+ Codecov patch coverage on the new routes; tests covering both a successful audit-list/delete and an unauthorized-access rejection.

Deliverables

• A route exposing listOverrideAudit.
• A route exposing deleteLiveOverride (validated via sanitizeOverridePayload).
• Tests for both routes, including auth rejection.

Expected Outcome

A self-host operator running the self-tune loop can inspect the override audit trail and clear a live override without direct D1 access.

Links & Resources

• src/review/auto-apply.ts:88,198,253 (the built-but-unrouted functions)
• src/api/routes.ts (where the new routes go)

[linear-code]

JSO-4277