Collapse review_action to what it now is: a per-project viewer name

[MJohnson459]

Splitting the review keys (#388) took the medium decision away from
projects.review_action and left it naming one thing: which [viewers.<name>]
table a project's local diffs open in. The type still carried the old shape,
where ReviewAction::Auto, ::Pr and ::Viewer(None) were three spellings of
"name no viewer, use the default" — a value that has to be read twice before it
can be trusted.

What changed. The column is now projects.viewer, holding a viewer name or
NULL, and the enum is gone: Project::viewer is an Option<String>, and
Store::set_review_action is Store::set_viewer(project_id, Option<&str>),
which refuses a blank name rather than silently reading it as "the default".
Migration 0017 renames the column and converts in place — viewer:<name> keeps
its name; auto, pr and a bare viewer all become NULL.

The surface follows the type:

• voro project action <p> <auto|pr|viewer[:NAME]> is now
  voro project viewer <p> [NAME], naming no viewer to fall back to the
  config's default_viewer. It echoes demo viewer: default viewer -> zed.
• The projects screen's v picker lists the default viewer and each named
  viewer, dropping the auto/pr entries that did nothing distinguishable.
  Its title, key line and ? map entry now say "viewer".
• voro project list and the projects row keep the [viewer:NAME] marker,
  shown only when a project names one.
• The viewer-delete guard (CLI and Config screen) refuses with
  "viewer 'zed' is the viewer of demo — repoint it with voro project viewer <project> [NAME] before removing it".

DESIGN.md §5 (schema and the voro.toml prose), §8, §9 and §12 are updated in
the same change, as is the voro agent init skeleton comment, the README, and
the CHANGELOG.

Verification. cargo test --workspace (691 tests), clippy with -D warnings, and cargo fmt are clean. Two new tests cover the shape: a
round-trip over set_viewer including the blank-name refusal, and a migration
test that opens a v16 database carrying all five pre-split spellings and asserts
what each reads back as. Beyond that I ran the built binary against a copy of a
real v16 database — viewer:zed, pr, auto, a bare viewer and NULL all
migrated as intended — and drove the TUI in tmux: the v picker lists
default viewer / difftool / zed / new viewer… with (current) on the right
row, setting one paints [viewer:difftool] on the projects row and
viewer -> difftool on the status line, and choosing default viewer clears
it back.

Note for triage: this invalidates proposed task #135's implementation. #135
("Make the review next-action verb medium-aware") derives the verb from the
stored ReviewAction, mapping viewer/viewer:<name> to review and
auto/pr to pr. After #388 that reasoning was already unsound — g runs
the GitHub flow on a viewer project too — and after this change the values it
switches on no longer exist: every project either names a viewer or names none,
and neither says whether the project publishes. #135's problem may survive in
another form (a review row in a non-GitHub project still reads next: pr),
but its stated approach cannot be implemented as written. Left untouched rather
than silently retriaged.