feat(selfhost): complete review configuration control surface

[JSONbored]

Context

The self-host Docker stack now has private per-repo config, AI provider selection, Codex/Claude review modes, REES enrichment, inline comments, RAG, and observability pieces. The remaining gap is a coherent operator control surface: complete config templates, documented analyzer controls, and a future dashboard path that can generate/validate the same config without hand-editing YAML.

Child issues

• docs(selfhost): add complete and minimal review config templates #1682
• feat(review): test review controls end to end #1681
• feat(selfhost): expose REES analyzer controls and validation #1684
• feat(dashboard): design self-host review config generator #1683

Related existing work

• build(selfhost): Sentry source maps, env docs, and Grafana resource-hub link #1469 covers self-host Sentry source maps, release tracking, env docs, and Grafana resource-hub linking.
• chore(cloudflare): inventory legacy hosted resources for cleanup #1668 covers non-destructive Cloudflare legacy resource inventory and cleanup classification.

Requirements

• Keep the Docker stack safe for private repo policy: container-private config must remain supported and documented.
• Make every operator-facing review option discoverable with defaults, comments, allowed values, and deployment prerequisites.
• Treat REES analyzers as individually testable capabilities, not an opaque on/off service.
• Plan the dashboard generator so it writes/validates the same config schema rather than inventing a parallel settings model.
• Keep this maintainer-only until the config surface is stable enough for public contributor work.

Deliverables

• Child issues for the template files, REES analyzer controls/tests, CodeRabbit-style review controls, and dashboard config generator.
• A shared acceptance checklist tying docs, examples, env defaults, tests, and self-host smoke validation together.
• No destructive Cloudflare or host changes from this roadmap item.

Acceptance criteria

• All child issues are linked from this parent.
• Every child issue has concrete requirements and validation expectations.
• Labels are limited to maintainer-only; assignee is JSONbored.