fix: 支持 test→prd 两级流转的自动合并与 synchronize 事件

1. 自动合并门槛过严
   上一版要求 PR 目标必须等于 managed_branch 才自动合并，
   这会让两级流转（feature -> test -> prd）的第一级永远合不进去。
   改为：目标命中任一检查分支即可自动合并。
   managed_branch 退化为「push 无 PR 时的对比基准」与默认值。

2. Gitea 的 PR 更新事件名是 synchronized
   Gitea webhook 的 payload.action 用 synchronized，
   只有它的 Actions runner 才会改写成 GitHub 风格的 synchronize。
   原先只认 synchronize，导致「PR 有新提交」永远不触发。
   现在两种拼写都接受。

验证（真实 webhook，非手工触发）：
- feature -> test 开 PR：pull_request.opened 自动入队并审查
- 再推一个 commit：pull_request.synchronized 自动入队
- 无阻断问题 -> commit status success -> 自动 squash 合并，PR #4 已 merged
- 向未受保护分支推送会被正确过滤

app/lib/review.js

@@ -654,11 +654,11 @@ export class ReviewEngine {
       appendLog("auto-merge skipped: no pull request for this branch");
       return false;
     }
-    // Only merges into the managed branch are performed; a PR targeting any
-    // other branch is reviewed but never auto-merged.
-    const managed = repo.managed_branch || repo.base_branch;
-    if (job.base_ref && managed && job.base_ref !== managed) {
-      appendLog(`auto-merge skipped: PR targets ${job.base_ref}, managed branch is ${managed}`);
+    // A two-stage flow (feature -> test -> prd) legitimately merges into a
+    // checked branch that is not the managed branch, so the gate is "is the
+    // target one of the branches we protect", not "is it the managed branch".
+    if (job.base_ref && !branchMatches(job.base_ref, repo.check_branches)) {
+      appendLog(`auto-merge skipped: PR targets ${job.base_ref}, which is not a checked branch`);
       return false;
     }
     if (reviewIncomplete) {