gitea roles: add read:user scope for API login validation (#105)

End-to-end verification of the freshly-applied gitea engine (mint → API call → revoke) surfaced that tokens without read:user get 403 from GET /api/v1/user — the endpoint tea and most Gitea API clients use to validate a login. teabot's personalities would fail their auth check with the current scope sets, while in-scope calls (repo/issue) already work and lease revocation correctly kills tokens (verified 401 after revoke).

- add read:user to the teabot-implementer role scopes
- add read:user to the teabot-reviewer role scopes

Reviewed-on: #105
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

config/gitea_secret_backend_role/gitea/teabot-implementer.yaml

@@ -2,6 +2,8 @@
 # The implementer clones/pushes code and opens pull requests, so it gets write
 # on repositories (clone + push + PR create) and write on issues (PR/issue
 # comments). Read is implied by write. No admin/org/user-write scopes.
+# read:user is required because tea (and most API clients) validate the login
+# via GET /api/v1/user, which 403s without it (verified against a minted token).
 # Reading gitea/creds/teabot-implementer mints a lease-bound token deleted from
 # Gitea on revoke/expiry.
 ---
@@ -9,6 +11,7 @@ username: teabot-implementer
 scopes:
   - write:repository
   - write:issue
+  - read:user
 token_name_prefix: vault-teabot-implementer
 ttl: 3600      # 1h
 max_ttl: 14400 # 4h

config/gitea_secret_backend_role/gitea/teabot-reviewer.yaml

@@ -1,7 +1,9 @@
 # Role minting ephemeral tokens for the teabot-reviewer bot user.
 # The reviewer reads code and posts pull-request reviews/comments, so it gets
 # read on repositories (fetch diffs) and write on issues (PR reviews + issue/PR
-# comments). No repository-write, admin, org, or user scopes.
+# comments). No repository-write, admin, org, or user-write scopes.
+# read:user is required because tea (and most API clients) validate the login
+# via GET /api/v1/user, which 403s without it (verified against a minted token).
 # Reading gitea/creds/teabot-reviewer mints a lease-bound token deleted from
 # Gitea on revoke/expiry.
 ---
@@ -9,6 +11,7 @@ username: teabot-reviewer
 scopes:
   - read:repository
   - write:issue
+  - read:user
 token_name_prefix: vault-teabot-reviewer
 ttl: 3600      # 1h
 max_ttl: 14400 # 4h