chore(scripts): resolve Gitea token from keychain or config file

An exported GITEA_TOKEN only exists in the shell that exported it, so
tooling invoked from elsewhere could not find it. Resolve in order:
$GITEA_TOKEN, ~/.config/gitea/token, then the macOS Keychain — so the
token can live somewhere durable and non-world-readable instead of a
plaintext dotfile.

Also factors the API call and repo coordinates into scripts/lib/gitea.sh
so pr.sh and review.sh stop duplicating them, and adds
`review.sh --list` for enumerating open PRs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/pr.sh

@@ -2,20 +2,16 @@
 # Open a pull request against main from the current branch.
 #
 #   scripts/pr.sh "feat(ingest): parse Bryton FIT activities" [--draft]
-#
-# Requires GITEA_TOKEN (scopes: write:repository, write:issue) and optionally GITEA_URL.
 set -euo pipefail
-
-GITEA_URL="${GITEA_URL:-http://192.168.0.3:3000}"
-OWNER="${GITEA_OWNER:-BBergle}"
-REPO="${GITEA_REPO:-bike-app}"
-BASE="${PR_BASE:-main}"
+cd "$(dirname "$0")/.."
+. scripts/lib/gitea.sh
 
 die() { echo "error: $*" >&2; exit 1; }
 
-[ -n "${GITEA_TOKEN:-}" ] || die "GITEA_TOKEN is not set. See CONTRIBUTING.md."
+gitea_require_token || exit 1
 command -v jq >/dev/null || die "jq is required (brew install jq)."
 
+BASE="${PR_BASE:-main}"
 TITLE="${1:-}"
 [ -n "$TITLE" ] || die "usage: scripts/pr.sh \"<title>\" [--draft]"
 DRAFT=false
@@ -23,7 +19,6 @@ DRAFT=false
 
 BRANCH="$(git rev-parse --abbrev-ref HEAD)"
 [ "$BRANCH" != "$BASE" ] || die "refusing to open a PR from $BASE onto itself."
-
 git diff --quiet && git diff --cached --quiet || die "working tree is dirty; commit or stash first."
 
 if ! git rev-parse --verify "origin/$BRANCH" >/dev/null 2>&1; then
@@ -31,7 +26,6 @@ if ! git rev-parse --verify "origin/$BRANCH" >/dev/null 2>&1; then
   git push -u origin "$BRANCH"
 fi
 
-# Prefer the PR template; otherwise summarise the commits on this branch.
 if [ -f .gitea/PULL_REQUEST_TEMPLATE.md ]; then
   BODY="$(cat .gitea/PULL_REQUEST_TEMPLATE.md)"
 else
@@ -41,13 +35,8 @@ fi
 RESPONSE="$(jq -n \
   --arg title "$TITLE" --arg body "$BODY" \
   --arg head "$BRANCH" --arg base "$BASE" \
-  --argjson draft "$DRAFT" \
   '{title:$title, body:$body, head:$head, base:$base}' \
-  | curl -sS -X POST \
-      -H "Authorization: token $GITEA_TOKEN" \
-      -H "Content-Type: application/json" \
-      -d @- \
-      "$GITEA_URL/api/v1/repos/$OWNER/$REPO/pulls")"
+  | gitea_api POST pulls -d @-)"
 
 if URL="$(echo "$RESPONSE" | jq -er '.html_url' 2>/dev/null)"; then
   echo "PR opened: $URL"