chore(scripts): resolve Gitea token from keychain or config file

An exported GITEA_TOKEN only exists in the shell that exported it, so
tooling invoked from elsewhere could not find it. Resolve in order:
$GITEA_TOKEN, ~/.config/gitea/token, then the macOS Keychain — so the
token can live somewhere durable and non-world-readable instead of a
plaintext dotfile.

Also factors the API call and repo coordinates into scripts/lib/gitea.sh
so pr.sh and review.sh stop duplicating them, and adds
`review.sh --list` for enumerating open PRs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/lib/gitea.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Shared Gitea helpers. Source this; don't execute it.
+#
+# Token resolution, in order:
+#   1. $GITEA_TOKEN
+#   2. ~/.config/gitea/token          (chmod 600)
+#   3. macOS Keychain, service "gitea-bike-app"
+#
+# Store it in the Keychain (recommended — not readable as a plain file):
+#   security add-generic-password -a "$USER" -s gitea-bike-app -w '<token>' -U
+#
+# Or as a file:
+#   mkdir -p ~/.config/gitea && printf '%s' '<token>' > ~/.config/gitea/token
+#   chmod 600 ~/.config/gitea/token
+
+GITEA_URL="${GITEA_URL:-http://192.168.0.3:3000}"
+GITEA_OWNER="${GITEA_OWNER:-BBergle}"
+GITEA_REPO="${GITEA_REPO:-bike-app}"
+
+gitea_token() {
+  if [ -n "${GITEA_TOKEN:-}" ]; then
+    printf '%s' "$GITEA_TOKEN"; return 0
+  fi
+  if [ -r "$HOME/.config/gitea/token" ]; then
+    tr -d '\r\n' < "$HOME/.config/gitea/token"; return 0
+  fi
+  if command -v security >/dev/null 2>&1; then
+    if t="$(security find-generic-password -s gitea-bike-app -w 2>/dev/null)"; then
+      printf '%s' "$t"; return 0
+    fi
+  fi
+  return 1
+}
+
+gitea_require_token() {
+  if ! GITEA_TOKEN="$(gitea_token)" || [ -z "$GITEA_TOKEN" ]; then
+    cat >&2 <<'MSG'
+error: no Gitea token found.
+
+Store it once, either way:
+
+  security add-generic-password -a "$USER" -s gitea-bike-app -w '<token>' -U
+
+  # or
+  mkdir -p ~/.config/gitea && printf '%s' '<token>' > ~/.config/gitea/token
+  chmod 600 ~/.config/gitea/token
+
+Create the token at http://192.168.0.3:3000/user/settings/applications
+with scopes: read:user, write:repository, write:issue
+MSG
+    return 1
+  fi
+  export GITEA_TOKEN
+}
+
+# gitea_api <method> <path> [curl args...]  — path is relative to the repo
+gitea_api() {
+  local method="$1" path="$2"; shift 2
+  curl -sS -X "$method" \
+    -H "Authorization: token $GITEA_TOKEN" \
+    -H "Content-Type: application/json" \
+    "$@" \
+    "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/$path"
+}