fix: address PR Agent review findings across 6 files

Restrict PR Agent workflow to trusted collaborators on PR comments only,
fix UTF-8 byte counting in gallery-pack, correct portrait-to-landscape
fallback orientation, track inserted freeform beats in visitedBeatIds,
allow clearing stored TTS key, and guard empty-string fuzzy match in
style selector.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/api/gallery-pack/route.ts

@@ -27,7 +27,7 @@ export async function POST(req: Request): Promise<Response> {
     return Response.json({ error: "Bad JSON" }, { status: 400 });
   }
 
-  if (docStr.length > MAX_DOC_BYTES) {
+  if (new TextEncoder().encode(docStr).byteLength > MAX_DOC_BYTES) {
     return Response.json(
       { error: "图集数据太大,无法打包分享" },
       { status: 413 },