feat: bypass branch protection rules when merging

[Flo0806]

Summary

As a repository admin/maintainer, I want to merge PRs even when branch protection requirements (like required reviews or status checks) are not met — matching GitHub's "Merge without waiting for requirements to be met" functionality.

Additionally, work item pages should poll for changes in real-time so CI status, comments, and state changes appear automatically without manual refresh.

Changes

Bypass merge

• Query viewerCanMergeAsAdmin from GitHub's GraphQL API in the merge status endpoint
• Show a warning-colored merge button with bypass hint when the user has admin privileges but requirements aren't met
• Allow merge via REST API (admin bypass works automatically when enforce_admins is disabled)

Real-time polling

• Lightweight check endpoint (/work-items/{id}/check) using GitHub REST API with ETags
• 304 (not modified) = zero API cost, no reload
• 200 (changed) = invalidate server cache + smooth client-side update via ref replacement
• Polls every 20s while the work item page is open, stops on navigation

Context

GitHub's web UI allows admins to bypass branch protection rules when merging. Flumen previously only enabled the merge button when all requirements were met, which blocked admins from merging PRs that had failing checks or missing reviews.

For polling, GitHub's GraphQL API doesn't support ETags, so we use a lightweight REST ping on the issue/PR endpoint. Conditional requests returning 304 don't count against GitHub's rate limit.