feat: add --comments-file to pr review for inline comments (task 0035)

`pr review <n>` gains `--comments-file <path>`, a JSON array of inline
comments submitted with the review. Each entry is one of two exclusive
shapes: a new comment `{ path, line, body }` (mapped to `new_position`,
always the new side) or a reply `{ reply_to, body }`. A reply carries no
line or side — gitea-axi finds the target via the reviews-plus-comments
fan-out (there is no get-comment-by-id endpoint), reconstructs its anchor
from the target's own `diff_hunk`, and infers old/new side from it, so a
same-line post threads with the existing conversation. All entries map
onto the review-submission payload's `comments[]`; no new HTTP layer is
added. An unknown `reply_to` is a VALIDATION_ERROR raised before the POST,
and the submitted inline-comment count rides the action block.

The shared path-resolve-and-read behind --body-file and --comments-file is
extracted into src/flag-file.ts.

src/body-source.ts

@@ -1,7 +1,6 @@
-import { readFileSync } from "node:fs";
-import { isAbsolute, resolve } from "node:path";
 import type { CliDeps } from "./deps.js";
 import { axiError } from "./errors.js";
+import { readFlagFile } from "./flag-file.js";
 import { flagValue } from "./flags.js";
 
 /**
@@ -60,15 +59,5 @@ function bodyFlagSuggestion(command: string): string[] {
 }
 
 function readBodyFile(deps: CliDeps, path: string, command: string): string {
-  const absolute = isAbsolute(path) ? path : resolve(deps.cwd, path);
-  try {
-    return readFileSync(absolute, "utf8");
-  } catch (error) {
-    const reason = error instanceof Error ? error.message : String(error);
-    throw axiError(
-      `Cannot read --body-file ${path}: ${reason}`,
-      "VALIDATION_ERROR",
-      bodyFlagSuggestion(command),
-    );
-  }
+  return readFlagFile(deps, path, "--body-file", bodyFlagSuggestion(command));
 }