nisse-review: repository patterns, and the wall checked every round

At bring-up, nisse-review read no repositories: Gitea's /user/repos leaves
out a public repository's Read collaborators, so dev/nisse never showed up.
`repositories` now holds patterns (dev/nisse, dev/*, */*) matched against
every repository the account can read, public ones included (an
organization's or user's list, or the instance's search); unset, it is
/user/repos as before. A configured repository it can't read is left out
with an oplog line.

The read-only wall (R3) is checked every round, not only at startup: an
account granted push or admin while running stops (exit 3) rather than
review on.

nisse-core's Gitea client gains GiteaNotFound for 404s, owner_repositories
and visible_repositories.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

nisse-review.example.yaml

@@ -4,8 +4,8 @@
 # - Secrets are ${VARIABLE} references, resolved from the environment (or the
 #   .env file NISSE_ENV names) at startup. Nothing else goes there.
 # - Unknown keys are errors.
-# - Its Gitea account must have read access only, to every repository it can
-#   see: startup refuses an account that can push to one (R3).
+# - Its Gitea account must have read access only to every repository it
+#   reviews: it refuses to start, and stops, if it can push to one (R3).
 
 state_db: ~/nisse-review/state.db
 
@@ -24,7 +24,9 @@ gitea:
   token: ${NISSE_GITEA_TOKEN}         # the nisse-review account's
   operators: [operator]               # whose comments are the operator's (R4)
 
-# repositories: [owner/repo]          # only these; unset, every one it can read
+# repositories: ["dev/*"]             # patterns: owner/name, owner/*, */*;
+#                                     # public repositories included. Unset:
+#                                     # every one its account was given.
 
 # vault:                              # L10; memory/nisse-review rw for its memory
 #   root: ~/vault