Harden review workflow and repository checks

[DevvoLazza]

Summary

• apply the existing review list status, location, and limit filters instead of returning the full inbox
• move reviews to needs_attention when AI generation or Google publication fails, with audit events
• parameterize the PostgreSQL tenant context used for RLS
• add API and service coverage for filtering and provider failure recovery
• replace unrelated contributor instructions with AutoReview-specific repository guidance
• align package metadata with the repository's MIT license

Why

The repository structure is sound, but several existing contracts were not enforced at runtime. List filters were parsed and ignored, and provider failures could leave workflow records permanently stuck in transient states. The database tenant context also used string interpolation, while the contributor guide referenced an unrelated codebase.

Verification

• pnpm check
• pnpm audit --prod --audit-level high
• 19 tests passed
• API, worker, web, and mobile builds passed

Terraform files were not changed.