nisse-review: repository patterns, and the wall checked every round

At bring-up, nisse-review read no repositories: Gitea's /user/repos leaves
out a public repository's Read collaborators, so dev/nisse never showed up.
`repositories` now holds patterns (dev/nisse, dev/*, */*) matched against
every repository the account can read, public ones included (an
organization's or user's list, or the instance's search); unset, it is
/user/repos as before. A configured repository it can't read is left out
with an oplog line.

The read-only wall (R3) is checked every round, not only at startup: an
account granted push or admin while running stops (exit 3) rather than
review on.

nisse-core's Gitea client gains GiteaNotFound for 404s, owner_repositories
and visible_repositories.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Development-Plan.md

@@ -607,6 +607,10 @@ waits until two exist to compare. Moved, unchanged in behaviour:
   account can read (or the configured `repositories`); a work item per PR,
   ready unless a draft or titled WIP; closed when the PR merges or closes.
   Every open PR is reviewed, those open when it starts included (operator).
+  Since #153, `repositories` holds patterns (`dev/*`, `*/*`) matched against
+  every repository it can read, public ones included (Gitea's own list for the
+  account leaves out a public repository's Read collaborators, found at
+  bring-up); the read-only wall is checked every round, not only at startup.
 - **Reading (R3):** the repository at the PR's head and base, from Gitea's
   archives, unpacked into a scratch folder and read in Python (`read_file`,
   `list_files`, `search_code`), and its issues (`read_issue`,