Dashboard: /api/prs gives viewers the merge decision's hold reasons (found by #741's builder) #821

Outcome: a viewer sees no more of a PR's merge decision than /api/state and /api/events already show viewers. That's the same rule #741 (PR #816) applies to its first-task card, where viewers get 403 and no hold reason.

Why:

• The finding (inferred from the code, not run): First run: a card follows the first task from File one to its PR; the Start card counts only steps before Start (#741) [PROTECTED: owner merges] #816's builder found that GET /api/prs returns the merge decision's reasons to every role, viewers included.
• What the reasons expose: hold reasons can name review levels, guard categories, paths and policy states. First run: a card follows the first task from File one to its PR; the Start card counts only steps before Start (#741) [PROTECTED: owner merges] #816's viewer test asserts none of that reaches viewers through /api/state or /api/events.
• It predates First run: a card follows the first task from File one to its PR; the Start card counts only steps before Start (#741) [PROTECTED: owner merges] #816.

Do:

1. Measure it: a viewer session calls /api/prs against a fixture with a held PR.
2. If reasons are visible, scope them to writers. Viewers get the state only (waiting/merged), as elsewhere.
3. Add a test that fails without the change.

Review point: src/** is protected, so the owner merges.

Related: #741, #816, #706.