feat(server): production cut-over to Bun — notify_review, setup/callback, key resolution

- index.ts: add POST /api/v1/notify_review (queue-worker Discord bridge),
  /setup/callback (GitHub App manifest conversion), error logging on review
  failure, PR_AGENT_APP_DIR-based private key resolution
- config.ts: API key falls back to on-disk omniroute_key (same source as
  run_server.py) when no env key present — fixes 401 in systemd context
- markdown.ts: don't hyperlink non-URL ticket values (N/A)
- secrets.ts: fallback private key from ~/.hermes/keys + omni key ~/.hermes
- pr-queue-worker.py / auto_merge_bot.py: notify_review default port 4002→4023

Deploy: pr-agent-bun.service (Bun binary, port 4023) replaces
pr-agent-server.service (Python, port 4002, disabled). Caddy route updated in
asepharyana/infra (proxy 4023). Verified live: webhook → review → claude-opus-5
→ persistent GitHub comment published after Python shutdown.

server/src/config.ts

@@ -3,6 +3,8 @@
 // review pipeline, with env-var overrides (same names as the Python server used,
 // minus the Dynaconf prefix dance — we read plain env vars).
 
+import { readFileSync } from "node:fs";
+
 export interface Config {
   // model routing
   model: string;
@@ -84,11 +86,20 @@ export function loadConfig(): Config {
 
   // Key resolution: the Python server used ANTHROPIC_API_KEY = omni key for
   // 9router. Prefer OMNIROUTE_API_KEY (verified live), fall back to
-  // ANTHROPIC_API_KEY then OPENAI_API_KEY.
+  // ANTHROPIC_API_KEY then OPENAI_API_KEY, then the on-disk omni key file
+  // (same source of truth as run_server.py: /var/lib/pr-agent-server/omniroute_key).
+  const appDir = env.PR_AGENT_APP_DIR || "/var/lib/pr-agent-server";
+  let fileKey = "";
+  try {
+    fileKey = readFileSync(`${appDir}/omniroute_key`, "utf8").trim();
+  } catch {
+    // fall through
+  }
   const apiKey =
     env.OMNIROUTE_API_KEY ||
     env.ANTHROPIC_API_KEY ||
     env.OPENAI_API_KEY ||
+    fileKey ||
     "";
   const baseUrl =
     env.OPENAI_API_BASE || "https://9router.asepharyana.my.id/v1";