chore(scripts): resolve Gitea token from keychain or config file

An exported GITEA_TOKEN only exists in the shell that exported it, so
tooling invoked from elsewhere could not find it. Resolve in order:
$GITEA_TOKEN, ~/.config/gitea/token, then the macOS Keychain — so the
token can live somewhere durable and non-world-readable instead of a
plaintext dotfile.

Also factors the API call and repo coordinates into scripts/lib/gitea.sh
so pr.sh and review.sh stop duplicating them, and adds
`review.sh --list` for enumerating open PRs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/review.sh

@@ -1,28 +1,31 @@
 #!/usr/bin/env bash
-# Fetch a PR's diff and metadata for review.
+# Inspect a PR for review.
 #
-#   scripts/review.sh 7            # print the diff
-#   scripts/review.sh 7 --meta     # title, author, branch, CI state
-#
-# Requires GITEA_TOKEN.
+#   scripts/review.sh 7            diff
+#   scripts/review.sh 7 --meta     title, author, size, mergeability, CI state
+#   scripts/review.sh --list       open PRs
 set -euo pipefail
+cd "$(dirname "$0")/.."
+. scripts/lib/gitea.sh
+gitea_require_token || exit 1
 
-GITEA_URL="${GITEA_URL:-http://192.168.0.3:3000}"
-OWNER="${GITEA_OWNER:-BBergle}"
-REPO="${GITEA_REPO:-bike-app}"
+if [ "${1:-}" = "--list" ]; then
+  gitea_api GET "pulls?state=open&limit=30" \
+    | jq -r '.[] | "#\(.number)  \(.title)   [\(.head.ref)] by \(.user.login)"'
+  exit 0
+fi
 
-[ -n "${GITEA_TOKEN:-}" ] || { echo "error: GITEA_TOKEN not set" >&2; exit 1; }
 PR="${1:-}"
-[ -n "$PR" ] || { echo "usage: scripts/review.sh <pr-number> [--meta]" >&2; exit 1; }
-
-api() { curl -sS -H "Authorization: token $GITEA_TOKEN" "$GITEA_URL/api/v1/repos/$OWNER/$REPO/$1"; }
+[ -n "$PR" ] || { echo "usage: scripts/review.sh <pr-number> [--meta] | --list" >&2; exit 1; }
 
 if [ "${2:-}" = "--meta" ]; then
-  api "pulls/$PR" | jq '{number, title, user: .user.login, head: .head.ref, base: .base.ref,
-                         mergeable, draft, additions, deletions, changed_files}'
-  echo "--- commit status ---"
-  SHA="$(api "pulls/$PR" | jq -r '.head.sha')"
-  api "commits/$SHA/status" | jq '{state, statuses: [.statuses[]? | {context, state}]}'
+  gitea_api GET "pulls/$PR" | jq '{number, title, user: .user.login, head: .head.ref,
+                                   base: .base.ref, draft, mergeable,
+                                   additions, deletions, changed_files}'
+  echo "--- CI ---"
+  SHA="$(gitea_api GET "pulls/$PR" | jq -r '.head.sha')"
+  gitea_api GET "commits/$SHA/status" \
+    | jq '{state, checks: [.statuses[]? | {context, state}]}'
 else
-  api "pulls/$PR.diff"
+  gitea_api GET "pulls/$PR.diff"
 fi