feat(review): read-only endpoint exposing ORB's live self-tuned gate thresholds

[JSONbored]

Context

#6209 decided the design (see its pinned decision comment): a new read-only endpoint exposing ORB's live self-tuned gate thresholds, gated by the same isMcpReadRepoAllowed pattern already used elsewhere. This issue is the ORB-side endpoint only (the AMS-side consumer is a sibling issue).

Requirements

• New read-only route (in src/api/routes.ts, alongside the other MCP-facing routes that already call isMcpReadRepoAllowed) returning the live effective TunableOverride for a given repo: confidence_floor, scope_cap_files, scope_cap_lines only.
• Field allowlist is exact — do not add applied_at/clear_at or any override_audit data to the response. If the live row is absent, return whatever "no override active" shape this endpoint's sibling read routes already use for a similar not-found case (follow existing convention, don't invent a new response shape).
• Gate with isMcpReadRepoAllowed(env.MCP_READ_REPO_ALLOWLIST, repoFullName), returning the same { error: "forbidden_repo" } / 403 shape the existing routes at src/api/routes.ts:2354/2368/2959/3005 already use — match the existing pattern exactly rather than writing a new error shape.
• Read tunables_overrides (live) preferentially; if this repo also needs the shadow-override case considered, follow loadOverride/loadShadowOverride's existing precedence in src/review/auto-apply.ts rather than inventing new precedence logic.
• No new auth model, no new rate-limiting scheme — this is a small, cheap read; reuse whatever the sibling MCP-read routes already do for rate-limiting (if any).

Deliverables

• The new route + handler.
• OpenAPI schema entry (npm run ui:openapi regenerated and committed).
• Unit tests: allowed repo with a live override → correct field-limited response; allowed repo with no override → the existing not-found shape; disallowed repo → 403 forbidden_repo, identical to the existing precedent routes.

Test Coverage Requirements

99%+ Codecov patch coverage on the diff (src/**), including the allowlist-denied branch and the no-override-present branch.

Expected Outcome

A repo-scoped, allowlist-gated, field-limited read of ORB's live gate thresholds exists for AMS (or any other allowlisted MCP-style caller) to consume — with zero exposure of override-audit history.

Links & Resources

• Spec: upgrade AMS's predicted-gate to query ORB's live self-tuned config when both are installed #6209 (design decision — read its pinned comment before starting)
• Epic: AMS + ORB combined-use synergy features (both installed on the same repo) #6206 (parent epic)
• src/auth/security.ts:183 (isMcpReadRepoAllowed), src/api/routes.ts (existing precedent routes using it)
• src/review/auto-apply.ts (TunableOverride, loadOverride, loadShadowOverride)

[linear-code]

JSO-4450