nisse-review: repository patterns, and the wall checked every round

At bring-up, nisse-review read no repositories: Gitea's /user/repos leaves
out a public repository's Read collaborators, so dev/nisse never showed up.
`repositories` now holds patterns (dev/nisse, dev/*, */*) matched against
every repository the account can read, public ones included (an
organization's or user's list, or the instance's search); unset, it is
/user/repos as before. A configured repository it can't read is left out
with an oplog line.

The read-only wall (R3) is checked every round, not only at startup: an
account granted push or admin while running stops (exit 3) rather than
review on.

nisse-core's Gitea client gains GiteaNotFound for 404s, owner_repositories
and visible_repositories.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

nisse-review/tests/review_fakes.py

@@ -8,6 +8,7 @@ from typing import Any
 from nisse_core.gitea import (
     Comment,
     GiteaError,
+    GiteaNotFound,
     Issue,
     LineComment,
     PullRequest,
@@ -69,6 +70,9 @@ class FakeGitea:
     comments: list[tuple[str, int, str]] = field(default_factory=list)
     refuse_off_diff: bool = False
     down: bool = False
+    # Readable but not given (public): missing from /user/repos, as Gitea
+    # leaves a public repository's Read collaborators out of it.
+    public: set[str] = field(default_factory=set)
 
     def _up(self) -> None:
         if self.down:
@@ -78,10 +82,23 @@ class FakeGitea:
         return self.account
 
     def readable_repositories(self) -> list[str]:
+        self._up()
+        return [r for r in self.repos if r not in self.public]
+
+    def visible_repositories(self) -> list[str]:
         self._up()
         return list(self.repos)
 
+    def owner_repositories(self, owner: str) -> list[str]:
+        self._up()
+        found = [r for r in self.repos if r.startswith(f"{owner}/")]
+        if not found:
+            raise GiteaNotFound(f"no owner {owner}")
+        return found
+
     def repository(self, repo: str) -> dict[str, Any]:
+        if repo not in self.repos:
+            raise GiteaNotFound(f"no repository {repo}")
         return {
             "permissions": self.permissions.get(
                 repo, {"pull": True, "push": False, "admin": False}