feat(reviewer): support configuring a dedicated lightweight reviewer model (#615)

[cagdasyurekli]

Closes #615

Summary

This PR allows users to configure an optional, dedicated reviewer model for auto-approve mode instead of always inheriting the session's primary model:

• Adds reviewer_model: Optional[str] = None to Config in coworker/config.py.
• Supports configuring via user-global config.toml using either [reviewer] model = "..." or reviewer_model = "...".
• Preserves security invariants by classifying reviewer_model as a user-global field so workspace configurations cannot override or tamper with the reviewer model.
• Adds reviewer_model argument to build_engine in coworker/agent.py and passes it to Reviewer.
• Wires reviewer_model through SessionManager and exposes REST endpoint POST /v1/settings/reviewer-model and GET /v1/settings.
• If omitted or empty, seamlessly falls back to session.model (preserving 100% backward compatibility).
• Added comprehensive unit tests in tests/test_config.py and tests/test_auto_approve_settings.py.

Verification

• pytest tests/test_auto_approve_settings.py tests/test_config.py tests/test_auto_approve.py tests/test_shadow_eval.py (116/116 passed).