feat(gitea): surface mathias's own open Gitea issues on stage 03 (#4)

TDD: IssueNodes parses /repos/issues/search into stage nodes (title, repo
tag, clickable html_url). gitea.MyIssues() reads GITEA_TOKEN and skips
gracefully when unset, mirroring the existing liveOverlay fallback pattern.

Single-operator homelab, not per-visitor OAuth: a static read-only PAT
gates on "cleared Authentik forward-auth", not per-user token exchange —
see #4 discussion. GITEA_TOKEN provisioning in infra (ExternalSecret) is
a separate follow-up; without it the overlay is inert (no crash, just no
live nodes), so this ships safely ahead of that wiring.

Nodes with a url now render as clickable <a class="node"> instead of
<div class="node">.

internal/web/handler.go

@@ -56,6 +56,13 @@ func NewHandler() http.Handler {
 				}
 			}
 		}
+		if ld.issues != nil {
+			for i := range a.Stages {
+				if a.Stages[i].Generate == "gitea-issues" {
+					a.Stages[i].Nodes = append(ld.issues, a.Stages[i].Nodes...)
+				}
+			}
+		}
 		if ld.deploy != nil || ld.flux != nil {
 			var live []atlas.Node
 			if ld.deploy != nil {
@@ -84,6 +91,7 @@ type liveOverlayData struct {
 	deploy   *atlas.Deploy
 	flux     *atlas.Flux
 	timeline []atlas.RunDot
+	issues   []atlas.Node
 }
 
 // live cache: query the cluster at most once per TTL; fall back to the authored
@@ -123,6 +131,11 @@ func liveOverlay() liveOverlayData {
 			d.timeline = dots
 		}
 	}
+	if raw, err := gitea.MyIssues(); err == nil {
+		if nodes, err := atlas.IssueNodes(raw); err == nil {
+			d.issues = nodes
+		}
+	}
 	if raw, err := cluster.Deployment(); err == nil {
 		if dep, err := atlas.DeployState(raw); err == nil {
 			d.deploy = &dep