feat: store reviews and capture human feedback

[SimonOyaneder]

Summary

• Persists every Canon review (with all findings) to PostgreSQL when posted
• Captures human replies to Canon inline comments and links them to the original finding
• Adds pull_request_review_comment.created webhook handler for feedback capture

Schema

pr_reviews (1 per review posted)
  └── pr_review_findings (N per review, 1 per finding)
        └── review_feedback (M per finding, 1 per human reply)

Changes

• Migration 0002_review-storage.sql — 3 new tables with indexes
• src/db/review-store.ts — storeReview() (transactional) + storeFeedback() (idempotent)
• src/github/feedback-handler.ts — validates parent is Canon bot comment, stores feedback
• src/review/commenter.ts — postReview returns PostReviewResult with review ID, comment IDs, findings, event
• src/github/pr-handler.ts — calls storeReview after posting (graceful on failure)
• src/index.ts — registers new webhook event

Test plan

• npm run lint passes (tsc --noEmit)
• npm test — 306 tests across 28 suites pass
• npm run build compiles cleanly
• New tests cover: storeReview transaction + rollback, storeFeedback lookup + idempotency, feedback handler skip logic for non-replies/bots/non-Canon comments, pr-handler storeReview integration + error resilience

🤖 Generated with Claude Code

[canon-review]

Found 3 pattern deviations: ⚪ 3 low

Additional findings

⚪ src/github/pr-handler.ts — Style Inconsistency · confidence: 98%

Config is imported as a value import even though it is only used as a type; this deviates from existing type-only import usage.

Suggested fix:

import type { Config } from "../config";

Reference: src/review/reviewer.ts

---

[canon-review]

⚪ Style Inconsistency · low · confidence: 99%

Type import is not using the repo’s type-only import pattern for TypeScript types.

Existing pattern: Types are imported with import type where appropriate.
Reference: src/review/reviewer.ts

Suggested change

	import { Finding } from "../review/reviewer";
	import type { Finding } from "../review/reviewer";

[canon-review]

⚪ Style Inconsistency · low · confidence: 98%

Type import from Probot is not using type-only import syntax, which is used in the codebase for type-only dependencies.

Existing pattern: Type-only imports are preferred for types/interfaces.
Reference: src/review/reviewer.ts

Suggested change

	import { Context } from "probot";
	import type { Context } from "probot";

[SimonOyaneder]

/canon review

[canon-review]

Found 2 pattern deviations: 🟡 1 medium · ⚪ 1 low

Additional findings

⚪ tests/github/pr-handler.test.ts — Style Inconsistency · confidence: 98%

Type import style is inconsistent with the established pattern; Config should be imported as type-only.

Suggested fix:

import type { Config } from "../../src/config";

Reference: src/github/pr-handler.ts

---

[canon-review]

🟡 Pattern Violation · medium · confidence: 95%

Catch variable name deviates from the repository’s DB transaction error-handling pattern (error + throw error).

Existing pattern: Transactional DB flows use catch (error) { await client.query("ROLLBACK"); throw error; } for consistency.
Reference: src/db/migrate.ts

Suggested change

	} catch (err) {
	} catch (error) {
	await client.query("ROLLBACK");
	throw error;
	}