BRIX-1411 add Quay review PR ingress

[lafawnduh1966]

Summary:

• Add dedicated-token POST /quay/review-pr to the API server with payload validation and structured Quay JSON responses.
• Invoke local quay-as-hermes review-pr with QUAY_DATA_DIR pinned to the Hermes profile data dir.
• Stage QUAY_REVIEW_PR_TOKEN through deploy secrets and document a GitHub Actions curl example.
• Cover auth, payload validation, command invocation, and Quay failure handling in API server tests.

Validation:

• bash -n stage-secrets.sh
• python -m py_compile gateway/platforms/api_server.py hermes_cli/config.py
• scripts/run_tests.sh tests/gateway/test_api_server.py::TestQuayReviewPrEndpoint
• scripts/run_tests.sh tests/gateway/test_api_server.py
• scripts/run_tests.sh tests/tools/test_local_env_blocklist.py

Linear: https://linear.app/inverter/issue/BRIX-1411/add-authenticated-http-endpoint-to-enroll-prs-for-quay-review

[linear]

BRIX-1411

[lafawnduh1966]

Addressed the two review notes in 9f28a3e:

• quay-as-hermes now preserves an explicit QUAY_DATA_DIR in both the same-user gateway path and the sudo/operator path, falling back to the install target only when unset.
• Added wrapper tests covering both override paths.
• Added the Quay review endpoint env vars and QUAY_DATA_DIR behavior to the public environment variable reference, and clarified the BRIX endpoint note/runbook wording.

Validation:

• bash -n ops/quay-as-hermes
• scripts/run_tests.sh tests/ops/test_quay_as_hermes_wrapper.py
• scripts/run_tests.sh tests/gateway/test_api_server.py::TestQuayReviewPrEndpoint