fix: send a team's permission before its units (Gitea 28), hidden private-org team reviews, long non-ASCII repo descriptions, -R NAME vs directory guard, flake fallback

Signed-off-by: bircni <bircni@icloud.com>

internal/services/review_requests.go

@@ -99,7 +99,8 @@ func (s Reviews) changeRequests(ctx context.Context, n int64, changes ReviewRequ
 
 // CheckRequestTeams verifies that every named team exists in the repository's organization. Gitea
 // lets only organization members list teams, though outside collaborators and the pull request
-// author may request reviews; when the lookup is forbidden the server checks the names, as for gh.
+// author may request reviews; when the lookup is forbidden, or the organization is hidden from the
+// caller (a private organization answers 404 to non-members), the server checks the names, as for gh.
 func (s Reviews) CheckRequestTeams(ctx context.Context, names []string) error {
 	owner, _, _ := strings.Cut(s.Repository, "/")
 	_, isOrg, err := organization(ctx, s.Client, owner)
@@ -110,10 +111,21 @@ func (s Reviews) CheckRequestTeams(ctx context.Context, names []string) error {
 		return err
 	}
 	if !isOrg {
+		// A private organization answers 404 to non-members, like a name nobody owns; a user that
+		// exists is certainly not an organization.
+		_, _, err := call(ctx, s.Client, func(ctx context.Context, c *gitea.Client) (*gitea.User, *gitea.Response, error) {
+			return c.Users.GetUserInfo(ctx, owner)
+		})
+		if IsNotFound(err) || IsForbidden(err) {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
 		return errors.New("team reviews require an organization repository")
 	}
 	teams, err := (Teams{Client: s.Client}).ByName(ctx, owner)
-	if IsForbidden(err) {
+	if IsForbidden(err) || IsNotFound(err) {
 		return nil
 	}
 	if err != nil {