Re-mint watchpr's Gitea token when it expires

Vault-minted Gitea tokens last ~1h, far less than a watch, and every poll
past expiry 401'd into a warning while watchpr looked healthy.

- retry a rejected request once with a freshly minted token
- abort the watch when the fresh token is rejected too
- poll anonymously when no token can be minted, mint only on a real 401/403

cmd/watchpr/main.go

@@ -58,10 +58,7 @@ func newRootCmd() *cobra.Command {
 				}
 				refs = append(refs, ref)
 			}
-			c, err := clientFor()
-			if err != nil {
-				return err
-			}
+			c := clientFor()
 			if once {
 				return runOnce(c, refs, jsonMode)
 			}
@@ -84,12 +81,16 @@ func newRootCmd() *cobra.Command {
 	return root
 }
 
-func clientFor() (*agent.GiteaClient, error) {
+// clientFor builds the Gitea client. Watching public repos works anonymously,
+// so an unavailable token is a warning, not a failure; a poll that is actually
+// rejected re-mints then.
+func clientFor() *agent.GiteaClient {
 	token, err := agent.GiteaToken()
 	if err != nil {
-		return nil, err
+		fmt.Fprintf(os.Stderr, "warning: no Gitea token (%v); polling anonymously\n", err)
+		token = ""
 	}
-	return agent.NewGiteaClient(token), nil
+	return agent.NewGiteaClient(token)
 }
 
 // runOnce fetches and prints the current state of each PR, then exits 0.
@@ -131,6 +132,9 @@ func runWatch(c *agent.GiteaClient, refs []agent.PRRef, interval time.Duration,
 
 	res, err := agent.Watch(c, refs, login, ticker.C, onBaseline, onError)
 	if err != nil {
+		if agent.IsAuthError(err) {
+			return fmt.Errorf("gitea authentication failed after re-minting the token, watch aborted: %w", err)
+		}
 		return err
 	}
 	report(res.Ref.String(), res.Reason, res.State, jsonMode)