feat(review): add a read-only endpoint exposing ORB's live self-tuned gate thresholds for a repo

[JSONbored]

Context

Part of #6206 (AMS+ORB synergy epic) and specifically groundwork for #6209 (live-gate-prediction spec, still undecided on detection/exposure/auth model). Independent of how that spec eventually decides AMS should discover and authenticate to this data, it's useful groundwork to build the underlying read-only capability now: an endpoint that returns a repo's CURRENT effective, self-tuned gate thresholds (the output of src/review/auto-apply.ts's self-tune loop), with none of the raw override-audit history.

Requirements

• Add a read-only endpoint (e.g. GET /v1/repos/:owner/:repo/gate-config/effective) that returns only the effective, currently-active threshold values — reuse auto-apply.ts's existing loadOverride/loadShadowOverride read paths, but return ONLY the resolved effective values, never the raw audit trail (override_audit rows) or historical override sequence.
• This issue does NOT need to decide the auth/access model for who may call this (an external miner, a specific scope, etc.) — gate it behind whatever this repo's most conservative existing precedent already uses for a similar repo-scoped read (check #6154's reviewability-tool pattern, isMcpReadRepoAllowed), and note in the PR that Spec: upgrade AMS's predicted-gate to query ORB's live self-tuned config when both are installed #6209 may need to revisit the access model once its own design lands.
• Must remain read-only.

Test Coverage Requirements

99%+ Codecov patch coverage; tests confirming the response never includes raw audit-history fields, only resolved effective values.

Deliverables

• A read-only effective-gate-config endpoint, gated behind this repo's existing most-conservative repo-scoped read pattern.
• Tests confirming no audit-history leakage.

Expected Outcome

The underlying data-exposure capability #6209 needs already exists and is tested, so that spec's eventual implementation only needs to wire the detection/consumption logic, not also build this read path from scratch.

Links & Resources

• Epic: AMS + ORB combined-use synergy features (both installed on the same repo) #6206 (parent epic), Spec: upgrade AMS's predicted-gate to query ORB's live self-tuned config when both are installed #6209 (the spec this grounds work for)
• src/review/auto-apply.ts, migrations/0047_self_improve_tunables.sql
• #6154 (the isMcpReadRepoAllowed access-control precedent to reuse)

[linear-code]

JSO-4334