fix(web/app): close the contract gaps found by the five-domain API audit

Five parallel audits (chat, space, pulls, issues/repo, git internals) compared
every `Apis.*` call site against the Rust handlers and the generated schemas.
The recurring failures were shape and encoding, not field names.

- services/api: percent-encode path parameters once in `invoke`. The generated
  URL builders interpolate verbatim, so any branch, tag or release name
  containing `/` split the route into extra segments and 404'd — those refs
  could be created but never read back.
- chat: `list_pins` answers a bare `Vec<MessageDto>` (its utoipa body still
  claims a `Page`); `list_emojis` answers `Page<EmojiDto>` while the picker read
  it as an array and crashed on `.filter`. Fix both ends of that swap.
- settings: `my_suspensions` returns a bare array, not a page — the punishment
  history was silently empty.
- members: `GET /spaces/{s}/members` rows are flat `MemberSummary`, but four
  domains read `row.user`; every picker (add member, assignee, whitelist) was
  filtering on `undefined` and rendered empty. Fold the identity into `user`
  once in `lib/member-row.ts`.
- pulls: `update-branch` returns `{ pull, result }`, not a pull.
- repo: root commits no longer ask for a diff against the empty tree (the
  server's `rev_parse` 404s on that object); they render an explicit empty
  patch instead of rejecting the page. Commit paging stops at the `offset`
  ceiling of 5000. Branch/tag/admin page sizes drop to the server's 100 cap.
- three-state fields that are single `Option`s server-side cannot be cleared
  with `null` (`null` == absent): chat rate limits send `0`, repo description
  and website send the empty string, and a ban with an expiry is finished with
  a follow-up `update_ban`.
- issues: `attachment_ids` exists only on the create command; the edit form was
  carrying it into `PATCH`, where it was dropped.
- space admin: the member routes take the membership UUID, not the numeric user
  id — resolve it first, the way the ban helpers already did.