feat(atlas): surface the user's own Gitea repos on stage 05 (#10)

Adds the repos panel from #4's "Not yet shipped" list, following the shipped
issues slice (b2761a4) structurally rather than inventing a second approach:

- internal/atlas/repos.go — RepoNodes(), a pure parser over an already-decoded
  /user/repos response. Archived repos are dropped: the atlas shows where work
  happens, and an archived repo is by definition somewhere it does not.
- internal/gitea/client.go — MyRepos(), same PAT and same contract as MyIssues:
  errors when GITEA_TOKEN is unset so the caller skips the overlay rather than
  issuing an unauthenticated request. That unset path is the one running in
  prod today (#4), so it is tested, not assumed.
- internal/web/handler.go — wired into liveOverlay().

Stage 05 is the right home — repos are what the execution stage acts on — but
#11 had just claimed its `generate` key for stuck-badges, and a stage could
only name one source. So `generate` now accepts either spelling:

    "generate": "ci-jobs"
    "generate": ["stuck-badges", "gitea-repos"]

The bare string stays valid and marshals back as a bare string, so no authored
stage is rewritten and the frontend contract is unchanged. Stages 04 and 08
already share stuck-badges between them; this is the same growth one level in.

The overlay merge also moves out of the handler into atlas.PrependGenerated,
which is unit-testable where the inline loop was not — it sat behind a network
call. It covers the issues path too, and fixes a latent aliasing bug there: the
old `append(liveNodes, authored...)` wrote into the live slice's backing array,
so two stages sharing a key would corrupt each other. That shape is no longer
hypothetical now that stuck-badges spans three stages.

Verified end-to-end both ways: without GITEA_TOKEN the atlas returns 200 with
stage 05's authored nodes intact; with a real token stage 05 serves both
overlays at once — stuck badges, then eight live repos, then the authored
nodes — and a repo with no language emits one tag rather than an empty pill.

task check green (golangci-lint 0 issues, vet, -race).

Closes #10.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/atlas/generate.go

@@ -0,0 +1,63 @@
+package atlas
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+)
+
+// GenerateKeys names the live sources a stage draws nodes from. A stage grew
+// past one source once stuck-badges landed alongside the existing overlays, so
+// this accepts either spelling in atlas.json:
+//
+//	"generate": "ci-jobs"
+//	"generate": ["stuck-badges", "gitea-repos"]
+//
+// The bare string is kept rather than migrated: most stages have exactly one
+// source, and a one-element list reads worse for no benefit.
+type GenerateKeys []string
+
+// Has reports whether the stage draws from the named source. The empty key
+// never matches, so a stage with no `generate` is inert.
+func (g GenerateKeys) Has(key string) bool {
+	if key == "" {
+		return false
+	}
+	for _, k := range g {
+		if k == key {
+			return true
+		}
+	}
+	return false
+}
+
+func (g *GenerateKeys) UnmarshalJSON(b []byte) error {
+	b = bytes.TrimSpace(b)
+	if len(b) == 0 || string(b) == "null" {
+		*g = nil
+		return nil
+	}
+	if b[0] == '"' {
+		var one string
+		if err := json.Unmarshal(b, &one); err != nil {
+			return fmt.Errorf("parse generate: %w", err)
+		}
+		*g = GenerateKeys{one}
+		return nil
+	}
+	var many []string
+	if err := json.Unmarshal(b, &many); err != nil {
+		return fmt.Errorf("parse generate: %w", err)
+	}
+	*g = many
+	return nil
+}
+
+// MarshalJSON writes a lone key back as a bare string, so a round-trip through
+// the API does not rewrite every authored stage into list form.
+func (g GenerateKeys) MarshalJSON() ([]byte, error) {
+	if len(g) == 1 {
+		return json.Marshal(g[0])
+	}
+	return json.Marshal([]string(g))
+}