nisse-review: match repository patterns against Gitea's search

At bring-up, `dev/*` failed: listing an organization's repositories
(/orgs/dev/repos) needs the read:organization token scope, which the
reviewer's token doesn't have and shouldn't need. Patterns are now matched
against /repos/search, which needs only the repository scope and already
lists every repository the account can read. A pattern that matches
nothing is logged (access.no_match). owner_repositories goes.

A Gitea error at startup is now reported like a config error, not a
traceback.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

nisse-review/src/nisse_review/access.py

@@ -3,7 +3,10 @@
 The repositories are worked out again every round: ``repositories`` in the
 configuration is a list of patterns ("dev/nisse", "dev/*", "*/*"), matched
 against what the account can read, public repositories included; unset, it
-is every repository the account was given (``/user/repos``). Access is
+is every repository the account was given (``/user/repos``). Patterns are
+matched against Gitea's search, which needs only the token's repository
+scope: listing an organization's repositories would need
+``read:organization`` too. Access is
 managed in Gitea for private repositories and in the configuration for
 public ones.
 
@@ -35,22 +38,15 @@ def reviewed(
     """The repositories to review, sorted."""
     if patterns is None:
         return sorted(gitea.readable_repositories())
-    found: set[str] = set()
-    for pattern in patterns:
-        owner, _, name = pattern.partition("/")
-        if not _glob(owner) and not _glob(name):
-            found.add(pattern)  # checked by ``check``: it must be readable
-            continue
-        try:
-            candidates = (
-                gitea.visible_repositories()
-                if _glob(owner)
-                else gitea.owner_repositories(owner)
-            )
-        except GiteaNotFound:
-            oplog.emit("access.no_owner", cause="no such owner", pattern=pattern)
-            continue
-        found |= {repo for repo in candidates if fnmatchcase(repo, pattern)}
+    found = {p for p in patterns if not _glob(p)}  # ``check`` sees they're readable
+    globs = [p for p in patterns if _glob(p)]
+    if globs:
+        visible = gitea.visible_repositories()
+        for pattern in globs:
+            matched = {repo for repo in visible if fnmatchcase(repo, pattern)}
+            if not matched:
+                oplog.emit("access.no_match", cause="matches nothing", pattern=pattern)
+            found |= matched
     return sorted(found)