gitea roles: add read:user scope for API login validation

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

config/gitea_secret_backend_role/gitea/teabot-implementer.yaml

@@ -2,6 +2,8 @@
 # The implementer clones/pushes code and opens pull requests, so it gets write
 # on repositories (clone + push + PR create) and write on issues (PR/issue
 # comments). Read is implied by write. No admin/org/user-write scopes.
+# read:user is required because tea (and most API clients) validate the login
+# via GET /api/v1/user, which 403s without it (verified against a minted token).
 # Reading gitea/creds/teabot-implementer mints a lease-bound token deleted from
 # Gitea on revoke/expiry.
 ---
@@ -9,6 +11,7 @@ username: teabot-implementer
 scopes:
   - write:repository
   - write:issue
+  - read:user
 token_name_prefix: vault-teabot-implementer
 ttl: 3600      # 1h
 max_ttl: 14400 # 4h

config/gitea_secret_backend_role/gitea/teabot-reviewer.yaml

@@ -1,7 +1,9 @@
 # Role minting ephemeral tokens for the teabot-reviewer bot user.
 # The reviewer reads code and posts pull-request reviews/comments, so it gets
 # read on repositories (fetch diffs) and write on issues (PR reviews + issue/PR
-# comments). No repository-write, admin, org, or user scopes.
+# comments). No repository-write, admin, org, or user-write scopes.
+# read:user is required because tea (and most API clients) validate the login
+# via GET /api/v1/user, which 403s without it (verified against a minted token).
 # Reading gitea/creds/teabot-reviewer mints a lease-bound token deleted from
 # Gitea on revoke/expiry.
 ---
@@ -9,6 +11,7 @@ username: teabot-reviewer
 scopes:
   - read:repository
   - write:issue
+  - read:user
 token_name_prefix: vault-teabot-reviewer
 ttl: 3600      # 1h
 max_ttl: 14400 # 4h