B5: gh-compat /subscription endpoints over WatchLevel

[espadonne]

Summary

Note: Rebased onto trunk after #PR landing watching.go shipped /subscription endpoints with the server-native {level, explicit} shape. This PR retrofits the same endpoints to use the gh-compat {subscribed, ignored} body + response, per the B5 audit decision.

Replaces the {level, explicit} request/response shape on GET/PUT /api/v1/repos/{owner}/{repo}/subscription with the gh-compat pair so shithub api -X PUT .../subscription -F subscribed=true and other gh-style clients work without translation. subscribers list endpoint unchanged.

Mapping (handler-side translation onto WatchLevel):

• subscribed=true, ignored=false → SetWatch(all)
• subscribed=false, ignored=true → SetWatch(ignore)
• both false → UnsetWatch (204, back to implicit participating)
• both true → 422
• GET with no explicit row → 404 (gh-style)

Scopes unchanged: GET = repo:read, PUT/DELETE = user:write.

Test plan

Tests updated to match the new shape:

• TestWatching_GetNoExplicitReturns404
• TestWatching_PutSubscribedThenGetReflectsState
• TestWatching_PutIgnoredFlipsLevel
• TestWatching_PutBothTrueIs422
• TestWatching_PutBothFalseClears
• TestWatching_DeleteIsIdempotent
• TestWatching_SubscribersList — gh-compat PUT writes a row visible in subscribers list
• TestWatching_IgnoreExcludedFromSubscribers — ignore-level filter still applies
• TestWatching_PutRequiresUserWriteScope — 403 on repo-read-only token
• TestWatching_GetRequiresRepoRead — 403 on user-read-only token
• golangci-lint run — 0 issues
• Manual: shithub api -X PUT /repos/.../subscription -F subscribed=true against shithub.sh returns 200 + gh shape

Closes audit finding B5.