feat: 嚴重問題改用 Gitea 行內 review comment 標註檔案行數

每個新的嚴重問題改以行內 review comment 標註在問題所在的檔案與行數上，
留言內容為等級／審查員／建議；無法解析出行號（未標行號或一次列出多個
檔案），或行內留言失敗（該行不在 diff 範圍）時，降級為原本的一般 PR comment。

- gitea.js：新增 postPullReviewComment，呼叫 pull reviews API，以 new_position
  對應新版檔案行號、commit_id 帶 PR_HEAD_SHA
- comments.js：新增 parseLocation（支援 file:19 / file:70-82，取起始行）與
  行內留言內容組裝；postNewCriticalComments 先試行內、失敗降級，deps 可注入
- 補 11 個測試（API payload、parseLocation 各情境、行內成功與兩種降級路徑）
- README 更新流程第 7 步說明

app/ 測試 123 pass。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/gitea.test.js

@@ -1,7 +1,7 @@
 import { describe, it, afterEach, mock } from 'node:test';
 import assert from 'node:assert/strict';
 import axios from 'axios';
-import { getPRDiff, filterDiff, postComment, getCommitMessageBySha, getBranchHeadCommitMessage, shouldSkipBotCommit, getBotReviewOutcome } from './gitea.js';
+import { getPRDiff, filterDiff, postComment, postPullReviewComment, getCommitMessageBySha, getBranchHeadCommitMessage, shouldSkipBotCommit, getBotReviewOutcome } from './gitea.js';
 
 afterEach(() => mock.restoreAll());
 
@@ -57,6 +57,31 @@ describe('gitea', () => {
     await assert.rejects(() => postComment('test'), /api error/);
   });
 
+  it('postPullReviewComment posts an inline review comment to the pulls reviews API', async () => {
+    let capturedUrl, capturedBody, capturedOpts;
+    mock.method(axios, 'post', async (url, body, opts) => {
+      capturedUrl = url;
+      capturedBody = body;
+      capturedOpts = opts;
+      return { data: { id: 7 } };
+    });
+    const result = await postPullReviewComment({ path: 'app/preflight.js', line: 19, body: 'inline body' });
+    assert.deepEqual(result, { id: 7 });
+    assert.ok(capturedUrl.includes('/api/v1/repos/'));
+    assert.ok(capturedUrl.endsWith('/reviews'));
+    assert.equal(capturedBody.event, 'COMMENT');
+    assert.equal(capturedBody.comments.length, 1);
+    assert.equal(capturedBody.comments[0].path, 'app/preflight.js');
+    assert.equal(capturedBody.comments[0].new_position, 19);
+    assert.equal(capturedBody.comments[0].body, 'inline body');
+    assert.ok(capturedOpts.headers['Authorization'].startsWith('token '));
+  });
+
+  it('postPullReviewComment propagates axios errors', async () => {
+    mock.method(axios, 'post', async () => { throw new Error('not in diff'); });
+    await assert.rejects(() => postPullReviewComment({ path: 'a.js', line: 1, body: 'x' }), /not in diff/);
+  });
+
   it('getCommitMessageBySha reads commit message from Gitea API', async () => {
     let capturedUrl;
     mock.method(axios, 'get', async (url) => {