nisse-review: match repository patterns against Gitea's search

At bring-up, `dev/*` failed: listing an organization's repositories
(/orgs/dev/repos) needs the read:organization token scope, which the
reviewer's token doesn't have and shouldn't need. Patterns are now matched
against /repos/search, which needs only the repository scope and already
lists every repository the account can read. A pattern that matches
nothing is logged (access.no_match). owner_repositories goes.

A Gitea error at startup is now reported like a config error, not a
traceback.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Architecture.md

@@ -882,9 +882,9 @@ else) towards better changes.
   a draft, and not marked work in progress. Any author's: the operator's,
   `nisse-dev`'s, or another tool's. Its repositories are the ones its Gitea
   account was given, or, when configured, those matching patterns (`dev/*`,
-  `*/*`) among all it can read, public ones included: Gitea leaves a public
-  repository's Read collaborators out of an account's own list, so access to
-  public repositories is managed in configuration, and to private ones in Gitea.
+  `*/*`) among all it can read, public ones included, so a public repository
+  needs no grant in Gitea: access to public repositories is managed in
+  configuration, and to private ones in Gitea.
 - **A work item per PR,** scoped to its repository (L1). It closes when the PR
   merges or closes.
 - **What starts a run:** the PR becoming ready, a new push, or a new comment or