feat(pull): add bypass-rules opt-in and expose scheduled auto-merge via API

[bircni]

Reworks the pull request merge box to match GitHub's behaviour and surfaces auto-merge state on the API.

Merge box

• Bypassing branch protection is now an explicit, red "Merge without waiting for requirements to be met (bypass rules)" checkbox above the merge button, instead of a silent, automatic force-merge for admins.
• With unmet requirements and no bypass, the default action is now Enable auto merge — so admins (and bypass-allowlisted users) can schedule an auto-merge, not only force-merge.
• Ticking bypass switches to an immediate merge (button turns red); the two are mutually exclusive, so force_merge and merge_when_checks_succeed are never both sent.
• The merge-style dropdown now only selects the style and is hidden when a single style is allowed. The button and the pending-schedule notice name the style (e.g. "Enable auto merge (squash)").

API

• PullRequest responses gain a GitHub-compatible auto_merge object (enabled_by, merge_method, commit_title, commit_message), or null when not scheduled — on both the single-PR and list endpoints (batched to avoid N+1). Swagger regenerated.

Screenshots