feat(api): 1b — PR action route shell (merge + resolve-comments)

[neversettle17-101]

Part of #10 — Go HTTP Daemon lane. Sub-issue of umbrella #18.

⚠️ Scope: Interface-first. Register the two SCM/PR action routes as 200 with a structured planned body. No business logic. No real service impls. Route surface locked to the SCM section of the route analysis.

🔀 Supersedes #22.

Depends on

• feat(backend): HTTP daemon skeleton (Phase 1a) — #10 #14 (Skeleton).
• feat(api): 1b·a — Projects route shell (7 routes, REST-corrected) #20 (#18a Projects) — lands shared scaffolding: httpd/api.go, notimpl.go, errors.go.

Route surface (2 routes)

Both carry the different lane verdict — they belong to the SCM poller / webhook layer (feeding ApplySCMObservation), not the session/project REST API. Registered here as shells only.

Method	Path	Verdict	Notes
POST	/api/v1/prs/{id}/merge	different lane	Merge a PR.
POST	/api/v1/prs/{id}/resolve-comments	different lane	Resolve review comments on a PR.

Contract details

POST /api/v1/prs/{id}/merge

• Request: (none)
• 200 → { ok: true, prNumber, method: "squash" }
• 404 → unknown PR
• 409 → not mergeable
• 422 → merge preconditions unmet

POST /api/v1/prs/{id}/resolve-comments

• Request: { commentIds?: string[] } — omit to resolve all
• 200 → { ok: true, resolved: number }
• 404 → unknown PR
• 422 → nothing to resolve

Files

backend/internal/
  httpd/controllers/
    prs.go            NEW
    prs_test.go       NEW

Exit criteria

curl -i -XPOST localhost:3001/api/v1/prs/1/merge              # 200
curl -i -XPOST localhost:3001/api/v1/prs/1/resolve-comments   # 200

---

Closes part of #18.