nisse-review: repository patterns, and the wall checked every round

At bring-up, nisse-review read no repositories: Gitea's /user/repos leaves
out a public repository's Read collaborators, so dev/nisse never showed up.
`repositories` now holds patterns (dev/nisse, dev/*, */*) matched against
every repository the account can read, public ones included (an
organization's or user's list, or the instance's search); unset, it is
/user/repos as before. A configured repository it can't read is left out
with an oplog line.

The read-only wall (R3) is checked every round, not only at startup: an
account granted push or admin while running stops (exit 3) rather than
review on.

nisse-core's Gitea client gains GiteaNotFound for 404s, owner_repositories
and visible_repositories.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

nisse-review/src/nisse_review/main.py

@@ -9,6 +9,7 @@ from types import FrameType
 
 from nisse_core.config import ConfigError
 from nisse_core.envfile import load_env_file
+from nisse_review.access import AccessRefused
 from nisse_review.build import StartupError, build
 from nisse_review.config import ReviewConfig
 
@@ -35,6 +36,10 @@ def main() -> int:
     )
     try:
         built.scheduler.run_forever()
+    except AccessRefused as exc:
+        # R3: a grant made while it ran. It stops rather than review on.
+        print(f"nisse-review: stopping: {exc}", file=sys.stderr)
+        return 3
     finally:
         built.close()
     return 0