fix: honor Settings > Git > Default Branch, stop hardcoding "main"

[devlint]

Summary

• get_main_branch_name() (ops.rs) and a separately-implemented fallback in git_branch_merged (read.rs) both ended in a hardcoded "main" literal when nothing verified, causing git branch --format=...%(ahead-behind:main) / git branch --merged main to fail with fatal: failed to find 'main' on repos whose mainline is e.g. develop/trunk.
• Settings → Git → Default Branch existed in useSettings.ts/SettingsPanel.vue but was never passed to any backend command — purely cosmetic.
• New shared resolve_default_branch() in src/git/cmd.rs (used by both ops.rs and read.rs): configured setting → remote origin/HEAD symref → main/master/origin/main/origin/master → current branch (always resolves in a non-empty repo, replacing the old hardcoded literal). Mirrored in dev-server.mjs for pnpm dev:web parity.
• git_branches, git_branch_merged, git_branch_top_authors now take an optional default_branch param, threaded from settings.defaultBranch through backend.ts to every call site.
• Along the way: fixed a dev-server-only issue where introducing a user-configured value into what used to be a fixed 4-literal set exposed the pre-existing execSync + shell: true git-branches route to shell injection — switched to spawnSync with a discrete args array (no shell), per AGENTS.md's anti-injection rule.

Test plan

• New Rust unit tests for resolve_default_branch (5) using a real temp repo whose only branch is trunk
• New integration tests in ops.rs/read.rs (5) against real temp repos, including the exact fatal: failed to find 'main' regression and a configured-branch-wins case
• cargo test --lib: 176/176 pass
• pnpm test:parity: 15/15 pass
• Frontend suite: 651/651 pass
• vue-tsc --noEmit: no new errors

Fixes #136