feat(dashboard): mutate .pr-review.json via Gitea contents API

POST /r/<owner>/<name>/edit reads the current .pr-review.json via the
Gitea contents API (404 → start from {}), updates static_message and
model, then PUTs the file back as the bot identity. Static message is
stripped and capped at 400 chars; model is validated against
cost_model.PRICES (unknown → flash + redirect, no save). CSRF token is
the dashboard auth token (same value, simplest binding).

Helpers (_http) moved to urllib.request at module top so tests can patch
the entry point; the helper returns the Gitea status code so 404 (file
missing) cleanly omits sha on the create-PUT path.

6 tests under tests/pilot/test_dashboard_edit.py covering the happy
path, the 400-char cap, the unknown-model rejection, auth + CSRF gates,
and the file-missing creation path.

pilot/dashboard.py

@@ -34,7 +34,9 @@ import html
 import json
 import os
 import string
+import urllib.error
 import urllib.parse
+import urllib.request
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 
 from pilot import dashboard_data
@@ -439,7 +441,6 @@ def _http(method: str, url: str, *, token: str = "", body: dict | None = None,
           raw_body: bytes | None = None) -> tuple[int, bytes]:
     """Like ai_review._http but local: this module is stdlib-only and doesn't
     depend on the ai_review import (which pulls in a 1700-line reviewer)."""
-    import urllib.request
     headers = {"Accept": "application/json"}
     data: bytes | None = None
     if raw_body is not None: