MCP: add a REST route + CLI mirror for loopover_get_pr_ai_review_findings

[JSONbored]

Context

loopover_get_pr_ai_review_findings (src/mcp/server.ts:2158-2166, backed by loadPrAiReviewFindings in src/mcp/pr-ai-review-findings.ts) returns a submitted PR's structured, published AI-review findings (category/path/severity/body) for the PR's own author, gated by assertContributorOwnsPullRequest. It exists ONLY on the remote MCP server today — there is no REST route and no packages/loopover-mcp CLI command that reaches this data.

This is inconsistent with the repo's established pattern for per-contributor, DB-backed MCP tools: every comparable tool has BOTH a REST route AND a CLI mirror that calls it over HTTP:

• loopover_explain_score_breakdown → POST /v1/scoring/explain-breakdown (src/api/routes.ts:2108) → CLI registerStdioTool("loopover_explain_score_breakdown", ...) calling apiPost("/v1/scoring/explain-breakdown", body) (packages/loopover-mcp/bin/loopover-mcp.js:1512-1557).
• loopover_get_decision_pack → GET /v1/contributors/:login/decision-pack (src/api/routes.ts:3049) → CLI decision-pack command via getDecisionPackWithCache(login).
• loopover_explain_repo_decision → similarly mirrored by the CLI's repo-decision command.
• loopover_get_pr_reviewability → GET /v1/repos/:owner/:repo/pulls/:number/reviewability (src/api/routes.ts:2939) → CLI mirror exercised by test/unit/mcp-cli-pr-reviewability.test.ts.

loopover_get_pr_ai_review_findings breaks this pattern: a contributor using the local loopover-mcp CLI (rather than a client wired directly to the remote MCP server) currently has no way to retrieve their own PR's structured AI-review findings at all.

Requirements

• Add GET /v1/repos/:owner/:repo/pulls/:number/ai-review-findings to src/api/routes.ts, following the exact structure of the neighboring GET /v1/repos/:owner/:repo/pulls/:number/reviewability route (src/api/routes.ts:2939): parse/validate owner/repo/number from path params, read login from a required query parameter, call requireContributorAccess(c, login) (the same guard /v1/contributors/:login/decision-pack and /v1/agent/runs/:id already use) before touching any data, then call the existing loadPrAiReviewFindings(c.env, { repoFullName, pullNumber: number, login }) from src/mcp/pr-ai-review-findings.ts and return its result via c.json(...). Do not reimplement any of loadPrAiReviewFindings's logic in the route handler — it must be the single source of truth for both the MCP tool and the new REST route.
• Return 400 for a non-integer/non-positive number path param and for a missing login query param, matching the reviewability route's own validation style.
• In packages/loopover-mcp/bin/loopover-mcp.js, add a new registerStdioTool("loopover_get_pr_ai_review_findings", ...) block (placed with the other DB-backed remote-proxy tools such as loopover_explain_score_breakdown/loopover_get_pr_reviewability), with an input shape requiring owner, repo, number (positive int), and an optional login that falls back to activeProfile.session?.login / LOOPOVER_LOGIN / GITHUB_LOGIN the same way reviewPrCli/decisionPackCli already do, that calls apiGet against the new route with the login as a query parameter and returns the JSON body via toolResult(...).
• Add a matching entry to STDIO_TOOL_DESCRIPTORS (category "review", matching loopover_get_pr_ai_review_findings: "review" in the server's own MCP_TOOL_CATEGORIES) so the tool appears in loopover-mcp tools.

Deliverables

• GET /v1/repos/:owner/:repo/pulls/:number/ai-review-findings route added to src/api/routes.ts
• loopover_get_pr_ai_review_findings stdio tool registered in packages/loopover-mcp/bin/loopover-mcp.js, with a STDIO_TOOL_DESCRIPTORS entry
• New route-level test(s) covering: a ready PR with findings, a not_found PR, an ai_review_off repo, a 403 when login does not own the PR, and 400s for invalid number/missing login
• New CLI-level test(s) covering the stdio tool's apiGet call and login resolution, following the pattern in test/unit/mcp-cli-pr-reviewability.test.ts

Test Coverage Requirements

This touches src/api/routes.ts and packages/loopover-mcp/bin/loopover-mcp.js, both under src/**/packages/** — the repo's 99%+ Codecov patch gate applies in full. Every new branch listed in Deliverables above (ready/not_found/ai_review_off/forbidden/400s, plus the CLI's login-resolution fallback chain) must be covered by new tests.

Expected Outcome

A contributor using the local loopover-mcp CLI can retrieve their own PR's structured AI-review findings the same way they can already fetch a decision pack, repo decision, or PR reviewability report — closing the one MCP-only tool of its kind that currently has neither a REST route nor a CLI mirror.

Links & Resources

• src/mcp/server.ts:2158-2166 (existing MCP tool registration) and src/mcp/pr-ai-review-findings.ts (loadPrAiReviewFindings, assertContributorOwnsPullRequest — reuse as-is)
• src/api/routes.ts:2939-2971 (GET .../reviewability, the route to model the new one on)
• src/api/routes.ts:3049-3055 (GET /v1/contributors/:login/decision-pack, the requireContributorAccess precedent)
• packages/loopover-mcp/bin/loopover-mcp.js:1512-1557 (loopover_explain_score_breakdown stdio tool, the CLI-mirror pattern to copy)
• test/unit/mcp-cli-pr-reviewability.test.ts (existing CLI-mirror test precedent)
• test/unit/mcp-pr-ai-review-findings.test.ts (existing server-side test to extend/mirror at the route level)

[linear-code]

JSO-4504