Add fail-closed author allowlist gating job dispatch

Sessions run claude with --dangerously-skip-permissions and a prompt built
from issue/PR/comment text, so only trusted authors may supply that text.
teabot now dispatches a job only when the triggering event's author login is
on an allowlist; an empty allowlist dispatches nothing (fail-closed).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

internal/dispatch/dispatch.go

@@ -36,6 +36,8 @@ type StateStore interface {
 	ActedOnPull(repo string, index int64) bool
 	MarkIssue(repo string, index int64)
 	MarkPull(repo string, index int64)
+	MarkIssueProcessed(repo string, index int64)
+	MarkPullProcessed(repo string, index int64)
 	MarkComment(repo string, id int64)
 	Seeded(repo string) bool
 	MarkSeeded(repo string)