feat: add close/reopen and comment actions to issue detail view

Add SetIssueState client method and handler for toggling issue state
between open and closed via PATCH API. Add AddComment client method
wrapping PostComment. Register new routes POST /issues/{owner}/{repo}/{index}/state
and POST /issues/{owner}/{repo}/{index}/comments. Update issue_detail.html
template with comment form (HTMX inline append) and close/reopen button
(HTMX inline swap of state badge).

Closes leeworks-agents/gitea-mobile#29

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -0,0 +1,8 @@
+.git
+.gitignore
+*.md
+flake.nix
+flake.lock
+.envrc
+.direnv
+.claude

.gitea/workflows/build.yaml

@@ -0,0 +1,41 @@
+name: Build and Push
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.22'
+
+      - name: Run tests
+        run: go test ./...
+
+  build:
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Login to Gitea registry
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login gitea.leeworks.dev \
+            -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+
+      - name: Build and push Docker image
+        run: |
+          TIMESTAMP=$(date +%Y%m%d%H%M%S)
+          SHA=$(echo ${{ gitea.sha }} | cut -c1-7)
+          TAG="${TIMESTAMP}-${SHA}"
+          docker build -t gitea.leeworks.dev/0xwheatyz/gitea-mobile:${TAG} .
+          docker tag gitea.leeworks.dev/0xwheatyz/gitea-mobile:${TAG} \
+            gitea.leeworks.dev/0xwheatyz/gitea-mobile:latest
+          docker push gitea.leeworks.dev/0xwheatyz/gitea-mobile:${TAG}
+          docker push gitea.leeworks.dev/0xwheatyz/gitea-mobile:latest

Dockerfile

@@ -0,0 +1,16 @@
+# Stage 1: Build
+FROM golang:1.22-alpine AS builder
+WORKDIR /app
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /gitea-mobile ./cmd/server
+
+# Stage 2: Runtime
+FROM gcr.io/distroless/static:nonroot
+COPY --from=builder /gitea-mobile /gitea-mobile
+COPY static/ /static/
+COPY internal/templates/ /templates/
+EXPOSE 8080
+USER nonroot:nonroot
+ENTRYPOINT ["/gitea-mobile"]

cmd/server/main.go

@@ -1,14 +1,13 @@
 package main
 
 import (
-	"fmt"
 	"log"
 	"log/slog"
 	"net/http"
 	"os"
-	"strings"
 
 	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/config"
+	giteaclient "gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/gitea"
 	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/handlers"
 	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/middleware"
 )
@@ -24,33 +23,13 @@ func main() {
 		log.Fatalf("configuration error: %v", err)
 	}
 
-	// Determine if cookies should be marked Secure (disable for local dev).
-	secureCookies := !strings.HasPrefix(cfg.ListenAddr, "localhost") &&
-		!strings.HasPrefix(cfg.ListenAddr, "127.0.0.1")
+	// Create Gitea API client.
+	client := giteaclient.NewClient(cfg.GiteaURL)
 
+	// Create handler with all routes.
 	mux := http.NewServeMux()
-
-	// Health endpoint (no auth required).
-	mux.HandleFunc("GET /health", func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		fmt.Fprintln(w, "ok")
-	})
-
-	// Settings handler.
-	settingsHandler := &handlers.SettingsHandler{
-		SessionSecret: cfg.SessionSecret,
-		SecureCookies: secureCookies,
-	}
-	mux.HandleFunc("/settings", settingsHandler.ServeHTTP)
-
-	// Static file server.
-	mux.Handle("/static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static"))))
-
-	// Placeholder dashboard (will be replaced in issue #4/#5).
-	mux.HandleFunc("GET /", func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		fmt.Fprintln(w, "<h1>Gitea Mobile</h1><p>Dashboard coming soon.</p>")
-	})
+	h := handlers.NewHandler(cfg, client)
+	h.RegisterRoutes(mux)
 
 	// Apply middleware chain: logging -> auth.
 	var handler http.Handler = mux

internal/gitea/client.go

@@ -0,0 +1,816 @@
+// Package gitea provides an aggregation layer over the Gitea API,
+// supporting concurrent fetching across multiple organizations and repos
+// with in-memory caching.
+package gitea
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+)
+
+// Client wraps the Gitea API with aggregation and caching capabilities.
+type Client struct {
+	baseURL    string
+	httpClient *http.Client
+
+	mu    sync.RWMutex
+	cache map[string]*cacheEntry
+
+	// maxConcurrent controls the semaphore size for parallel API calls.
+	maxConcurrent int
+	// cacheTTL controls how long cache entries remain valid.
+	cacheTTL time.Duration
+}
+
+type cacheEntry struct {
+	data      interface{}
+	expiresAt time.Time
+}
+
+// Org represents a Gitea organization.
+type Org struct {
+	Name        string `json:"username"`
+	FullName    string `json:"full_name"`
+	Description string `json:"description"`
+	AvatarURL   string `json:"avatar_url"`
+}
+
+// Repo represents a Gitea repository.
+type Repo struct {
+	ID          int64  `json:"id"`
+	Name        string `json:"name"`
+	FullName    string `json:"full_name"`
+	Description string `json:"description"`
+	Owner       struct {
+		Login string `json:"login"`
+	} `json:"owner"`
+	HTMLURL   string    `json:"html_url"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
+
+// Issue represents a Gitea issue.
+type Issue struct {
+	ID     int64  `json:"id"`
+	Number int64  `json:"number"`
+	Title  string `json:"title"`
+	Body   string `json:"body"`
+	State  string `json:"state"`
+	Labels []struct {
+		ID    int64  `json:"id"`
+		Name  string `json:"name"`
+		Color string `json:"color"`
+	} `json:"labels"`
+	Assignee *struct {
+		Login     string `json:"login"`
+		AvatarURL string `json:"avatar_url"`
+	} `json:"assignee"`
+	Assignees []struct {
+		Login     string `json:"login"`
+		AvatarURL string `json:"avatar_url"`
+	} `json:"assignees"`
+	HTMLURL   string    `json:"html_url"`
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+	RepoOwner string    `json:"-"` // populated after fetch
+	RepoName  string    `json:"-"` // populated after fetch
+}
+
+// PullRequest represents a Gitea pull request.
+type PullRequest struct {
+	ID     int64  `json:"id"`
+	Number int64  `json:"number"`
+	Title  string `json:"title"`
+	Body   string `json:"body"`
+	State  string `json:"state"`
+	Labels []struct {
+		ID    int64  `json:"id"`
+		Name  string `json:"name"`
+		Color string `json:"color"`
+	} `json:"labels"`
+	User *struct {
+		Login     string `json:"login"`
+		AvatarURL string `json:"avatar_url"`
+	} `json:"user"`
+	Mergeable bool   `json:"mergeable"`
+	HTMLURL   string `json:"html_url"`
+	DiffURL   string `json:"diff_url"`
+	Additions int    `json:"additions"`
+	Deletions int    `json:"deletions"`
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+	RepoOwner string    `json:"-"` // populated after fetch
+	RepoName  string    `json:"-"` // populated after fetch
+}
+
+// TriageItem represents an item in the triage queue.
+type TriageItem struct {
+	Type      string    // "issue" or "pull"
+	RepoOwner string
+	RepoName  string
+	Number    int64
+	Title     string
+	HTMLURL   string
+	Labels    []string
+	UpdatedAt time.Time
+}
+
+// NewClient creates a new Gitea API client.
+func NewClient(baseURL string) *Client {
+	return &Client{
+		baseURL: strings.TrimRight(baseURL, "/"),
+		httpClient: &http.Client{
+			Timeout: 30 * time.Second,
+		},
+		cache:         make(map[string]*cacheEntry),
+		maxConcurrent: 5,
+		cacheTTL:      30 * time.Second,
+	}
+}
+
+// doRequest performs an authenticated HTTP request to the Gitea API.
+func (c *Client) doRequest(ctx context.Context, token, method, path string, body io.Reader) (*http.Response, error) {
+	url := c.baseURL + "/api/v1" + path
+
+	req, err := http.NewRequestWithContext(ctx, method, url, body)
+	if err != nil {
+		return nil, fmt.Errorf("creating request: %w", err)
+	}
+
+	req.Header.Set("Authorization", "token "+token)
+	req.Header.Set("Accept", "application/json")
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("executing request: %w", err)
+	}
+
+	if resp.StatusCode >= 400 {
+		defer resp.Body.Close()
+		respBody, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("API error %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	return resp, nil
+}
+
+// getFromCache returns cached data if still valid.
+func (c *Client) getFromCache(key string) (interface{}, bool) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	entry, ok := c.cache[key]
+	if !ok || time.Now().After(entry.expiresAt) {
+		return nil, false
+	}
+	return entry.data, true
+}
+
+// setCache stores data in cache with TTL.
+func (c *Client) setCache(key string, data interface{}) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.cache[key] = &cacheEntry{
+		data:      data,
+		expiresAt: time.Now().Add(c.cacheTTL),
+	}
+}
+
+// invalidateCache removes entries matching the given prefix.
+func (c *Client) invalidateCache(prefix string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	for k := range c.cache {
+		if strings.HasPrefix(k, prefix) {
+			delete(c.cache, k)
+		}
+	}
+}
+
+// InvalidateAll clears the entire cache (called on write operations).
+func (c *Client) InvalidateAll() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.cache = make(map[string]*cacheEntry)
+}
+
+// ListOrgs returns the organizations the authenticated user belongs to.
+func (c *Client) ListOrgs(ctx context.Context, token string) ([]Org, error) {
+	cacheKey := "orgs"
+	if cached, ok := c.getFromCache(cacheKey); ok {
+		return cached.([]Org), nil
+	}
+
+	resp, err := c.doRequest(ctx, token, http.MethodGet, "/user/orgs?limit=50", nil)
+	if err != nil {
+		return nil, fmt.Errorf("listing orgs: %w", err)
+	}
+	defer resp.Body.Close()
+
+	var orgs []Org
+	if err := json.NewDecoder(resp.Body).Decode(&orgs); err != nil {
+		return nil, fmt.Errorf("decoding orgs: %w", err)
+	}
+
+	c.setCache(cacheKey, orgs)
+	return orgs, nil
+}
+
+// ListOrgRepos returns all repositories for a given organization.
+func (c *Client) ListOrgRepos(ctx context.Context, token, org string) ([]Repo, error) {
+	cacheKey := fmt.Sprintf("repos-%s", org)
+	if cached, ok := c.getFromCache(cacheKey); ok {
+		return cached.([]Repo), nil
+	}
+
+	var allRepos []Repo
+	page := 1
+	for {
+		path := fmt.Sprintf("/orgs/%s/repos?limit=50&page=%d", org, page)
+		resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
+		if err != nil {
+			return nil, fmt.Errorf("listing repos for %s: %w", org, err)
+		}
+
+		var repos []Repo
+		if err := json.NewDecoder(resp.Body).Decode(&repos); err != nil {
+			resp.Body.Close()
+			return nil, fmt.Errorf("decoding repos: %w", err)
+		}
+		resp.Body.Close()
+
+		if len(repos) == 0 {
+			break
+		}
+		allRepos = append(allRepos, repos...)
+		if len(repos) < 50 {
+			break
+		}
+		page++
+	}
+
+	c.setCache(cacheKey, allRepos)
+	return allRepos, nil
+}
+
+// ListOrgsAndRepos returns a map of org name to repos for all orgs the user belongs to.
+func (c *Client) ListOrgsAndRepos(ctx context.Context, token string) (map[string][]Repo, error) {
+	orgs, err := c.ListOrgs(ctx, token)
+	if err != nil {
+		return nil, err
+	}
+
+	result := make(map[string][]Repo)
+	var mu sync.Mutex
+	sem := make(chan struct{}, c.maxConcurrent)
+	var wg sync.WaitGroup
+	var firstErr error
+
+	for _, org := range orgs {
+		wg.Add(1)
+		go func(orgName string) {
+			defer wg.Done()
+			sem <- struct{}{}
+			defer func() { <-sem }()
+
+			repos, err := c.ListOrgRepos(ctx, token, orgName)
+			if err != nil {
+				mu.Lock()
+				if firstErr == nil {
+					firstErr = err
+				}
+				mu.Unlock()
+				return
+			}
+
+			mu.Lock()
+			result[orgName] = repos
+			mu.Unlock()
+		}(org.Name)
+	}
+
+	wg.Wait()
+
+	if firstErr != nil {
+		return nil, firstErr
+	}
+	return result, nil
+}
+
+// ListAllIssues fetches all open issues across all repos in the given orgs,
+// using concurrent requests with a semaphore.
+func (c *Client) ListAllIssues(ctx context.Context, token string, orgs []string) ([]Issue, error) {
+	cacheKey := fmt.Sprintf("issues-%s", strings.Join(orgs, ","))
+	if cached, ok := c.getFromCache(cacheKey); ok {
+		return cached.([]Issue), nil
+	}
+
+	// First, collect all repos for the given orgs.
+	var allRepos []Repo
+	for _, org := range orgs {
+		repos, err := c.ListOrgRepos(ctx, token, org)
+		if err != nil {
+			return nil, fmt.Errorf("listing repos for %s: %w", org, err)
+		}
+		allRepos = append(allRepos, repos...)
+	}
+
+	// Fan out issue fetching across repos.
+	var allIssues []Issue
+	var mu sync.Mutex
+	sem := make(chan struct{}, c.maxConcurrent)
+	var wg sync.WaitGroup
+	var firstErr error
+
+	for _, repo := range allRepos {
+		wg.Add(1)
+		go func(r Repo) {
+			defer wg.Done()
+			sem <- struct{}{}
+			defer func() { <-sem }()
+
+			path := fmt.Sprintf("/repos/%s/issues?state=open&type=issues&limit=50", r.FullName)
+			resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
+			if err != nil {
+				mu.Lock()
+				if firstErr == nil {
+					firstErr = fmt.Errorf("fetching issues for %s: %w", r.FullName, err)
+				}
+				mu.Unlock()
+				return
+			}
+			defer resp.Body.Close()
+
+			var issues []Issue
+			if err := json.NewDecoder(resp.Body).Decode(&issues); err != nil {
+				mu.Lock()
+				if firstErr == nil {
+					firstErr = fmt.Errorf("decoding issues for %s: %w", r.FullName, err)
+				}
+				mu.Unlock()
+				return
+			}
+
+			// Tag each issue with repo info.
+			for i := range issues {
+				issues[i].RepoOwner = r.Owner.Login
+				issues[i].RepoName = r.Name
+			}
+
+			mu.Lock()
+			allIssues = append(allIssues, issues...)
+			mu.Unlock()
+		}(repo)
+	}
+
+	wg.Wait()
+
+	if firstErr != nil {
+		return nil, firstErr
+	}
+
+	// Sort by updated time, newest first.
+	sort.Slice(allIssues, func(i, j int) bool {
+		return allIssues[i].UpdatedAt.After(allIssues[j].UpdatedAt)
+	})
+
+	c.setCache(cacheKey, allIssues)
+	return allIssues, nil
+}
+
+// ListAllPullRequests fetches all open PRs across all repos in the given orgs.
+func (c *Client) ListAllPullRequests(ctx context.Context, token string, orgs []string) ([]PullRequest, error) {
+	cacheKey := fmt.Sprintf("pulls-%s", strings.Join(orgs, ","))
+	if cached, ok := c.getFromCache(cacheKey); ok {
+		return cached.([]PullRequest), nil
+	}
+
+	var allRepos []Repo
+	for _, org := range orgs {
+		repos, err := c.ListOrgRepos(ctx, token, org)
+		if err != nil {
+			return nil, fmt.Errorf("listing repos for %s: %w", org, err)
+		}
+		allRepos = append(allRepos, repos...)
+	}
+
+	var allPRs []PullRequest
+	var mu sync.Mutex
+	sem := make(chan struct{}, c.maxConcurrent)
+	var wg sync.WaitGroup
+	var firstErr error
+
+	for _, repo := range allRepos {
+		wg.Add(1)
+		go func(r Repo) {
+			defer wg.Done()
+			sem <- struct{}{}
+			defer func() { <-sem }()
+
+			path := fmt.Sprintf("/repos/%s/pulls?state=open&limit=50", r.FullName)
+			resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
+			if err != nil {
+				mu.Lock()
+				if firstErr == nil {
+					firstErr = fmt.Errorf("fetching PRs for %s: %w", r.FullName, err)
+				}
+				mu.Unlock()
+				return
+			}
+			defer resp.Body.Close()
+
+			var prs []PullRequest
+			if err := json.NewDecoder(resp.Body).Decode(&prs); err != nil {
+				mu.Lock()
+				if firstErr == nil {
+					firstErr = fmt.Errorf("decoding PRs for %s: %w", r.FullName, err)
+				}
+				mu.Unlock()
+				return
+			}
+
+			for i := range prs {
+				prs[i].RepoOwner = r.Owner.Login
+				prs[i].RepoName = r.Name
+			}
+
+			mu.Lock()
+			allPRs = append(allPRs, prs...)
+			mu.Unlock()
+		}(repo)
+	}
+
+	wg.Wait()
+
+	if firstErr != nil {
+		return nil, firstErr
+	}
+
+	sort.Slice(allPRs, func(i, j int) bool {
+		return allPRs[i].UpdatedAt.After(allPRs[j].UpdatedAt)
+	})
+
+	c.setCache(cacheKey, allPRs)
+	return allPRs, nil
+}
+
+// GetTriageQueue returns unassigned issues and PRs needing review, sorted by priority.
+func (c *Client) GetTriageQueue(ctx context.Context, token string, orgs []string) ([]TriageItem, error) {
+	issues, err := c.ListAllIssues(ctx, token, orgs)
+	if err != nil {
+		return nil, fmt.Errorf("fetching issues for triage: %w", err)
+	}
+
+	prs, err := c.ListAllPullRequests(ctx, token, orgs)
+	if err != nil {
+		return nil, fmt.Errorf("fetching PRs for triage: %w", err)
+	}
+
+	var queue []TriageItem
+
+	// Add unassigned issues.
+	for _, issue := range issues {
+		if issue.Assignee == nil && len(issue.Assignees) == 0 {
+			var labels []string
+			for _, l := range issue.Labels {
+				labels = append(labels, l.Name)
+			}
+			queue = append(queue, TriageItem{
+				Type:      "issue",
+				RepoOwner: issue.RepoOwner,
+				RepoName:  issue.RepoName,
+				Number:    issue.Number,
+				Title:     issue.Title,
+				HTMLURL:   issue.HTMLURL,
+				Labels:    labels,
+				UpdatedAt: issue.UpdatedAt,
+			})
+		}
+	}
+
+	// Add PRs (all open PRs may need review attention).
+	for _, pr := range prs {
+		var labels []string
+		for _, l := range pr.Labels {
+			labels = append(labels, l.Name)
+		}
+		queue = append(queue, TriageItem{
+			Type:      "pull",
+			RepoOwner: pr.RepoOwner,
+			RepoName:  pr.RepoName,
+			Number:    pr.Number,
+			Title:     pr.Title,
+			HTMLURL:   pr.HTMLURL,
+			Labels:    labels,
+			UpdatedAt: pr.UpdatedAt,
+		})
+	}
+
+	// Sort by priority labels (P1 > P2 > P3 > no priority), then by updated time.
+	sort.Slice(queue, func(i, j int) bool {
+		pi := priorityScore(queue[i].Labels)
+		pj := priorityScore(queue[j].Labels)
+		if pi != pj {
+			return pi < pj // lower score = higher priority
+		}
+		return queue[i].UpdatedAt.After(queue[j].UpdatedAt)
+	})
+
+	return queue, nil
+}
+
+// Comment represents a comment on an issue or pull request.
+type Comment struct {
+	ID        int64  `json:"id"`
+	Body      string `json:"body"`
+	User      string `json:"-"` // populated from nested object
+	CreatedAt string `json:"-"` // formatted after fetch
+	RawUser   struct {
+		Login string `json:"login"`
+	} `json:"user"`
+	RawCreatedAt time.Time `json:"created_at"`
+}
+
+// Label represents a Gitea label (used for available labels list).
+type Label struct {
+	ID    int64  `json:"id"`
+	Name  string `json:"name"`
+	Color string `json:"color"`
+}
+
+// GetIssue fetches a single issue by owner, repo, and index.
+func (c *Client) GetIssue(ctx context.Context, token, owner, repo string, index int64) (*Issue, error) {
+	path := fmt.Sprintf("/repos/%s/%s/issues/%d", owner, repo, index)
+	resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("fetching issue: %w", err)
+	}
+	defer resp.Body.Close()
+
+	var issue Issue
+	if err := json.NewDecoder(resp.Body).Decode(&issue); err != nil {
+		return nil, fmt.Errorf("decoding issue: %w", err)
+	}
+
+	issue.RepoOwner = owner
+	issue.RepoName = repo
+	return &issue, nil
+}
+
+// GetPull fetches a single pull request by owner, repo, and index.
+func (c *Client) GetPull(ctx context.Context, token, owner, repo string, index int64) (*PullRequest, error) {
+	path := fmt.Sprintf("/repos/%s/%s/pulls/%d", owner, repo, index)
+	resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("fetching pull request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	var pr PullRequest
+	if err := json.NewDecoder(resp.Body).Decode(&pr); err != nil {
+		return nil, fmt.Errorf("decoding pull request: %w", err)
+	}
+
+	pr.RepoOwner = owner
+	pr.RepoName = repo
+	return &pr, nil
+}
+
+// GetIssueComments fetches comments for an issue or pull request.
+func (c *Client) GetIssueComments(ctx context.Context, token, owner, repo string, index int64) ([]Comment, error) {
+	path := fmt.Sprintf("/repos/%s/%s/issues/%d/comments?limit=50", owner, repo, index)
+	resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("fetching comments: %w", err)
+	}
+	defer resp.Body.Close()
+
+	var comments []Comment
+	if err := json.NewDecoder(resp.Body).Decode(&comments); err != nil {
+		return nil, fmt.Errorf("decoding comments: %w", err)
+	}
+
+	// Populate convenience fields.
+	for i := range comments {
+		comments[i].User = comments[i].RawUser.Login
+		comments[i].CreatedAt = comments[i].RawCreatedAt.Format("Jan 2, 2006 15:04")
+	}
+
+	return comments, nil
+}
+
+// GetRepoLabels fetches all labels for a repository.
+func (c *Client) GetRepoLabels(ctx context.Context, token, owner, repo string) ([]Label, error) {
+	path := fmt.Sprintf("/repos/%s/%s/labels?limit=50", owner, repo)
+	resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
+	if err != nil {
+		return nil, fmt.Errorf("fetching labels: %w", err)
+	}
+	defer resp.Body.Close()
+
+	var labels []Label
+	if err := json.NewDecoder(resp.Body).Decode(&labels); err != nil {
+		return nil, fmt.Errorf("decoding labels: %w", err)
+	}
+
+	return labels, nil
+}
+
+// CreateIssue creates a new issue in the specified repository.
+func (c *Client) CreateIssue(ctx context.Context, token, owner, repo, title, body string, labels []int64) (*Issue, error) {
+	payload := map[string]interface{}{
+		"title": title,
+		"body":  body,
+	}
+	if len(labels) > 0 {
+		payload["labels"] = labels
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling issue: %w", err)
+	}
+
+	path := fmt.Sprintf("/repos/%s/%s/issues", owner, repo)
+	resp, err := c.doRequest(ctx, token, http.MethodPost, path, strings.NewReader(string(jsonData)))
+	if err != nil {
+		return nil, fmt.Errorf("creating issue: %w", err)
+	}
+	defer resp.Body.Close()
+
+	var issue Issue
+	if err := json.NewDecoder(resp.Body).Decode(&issue); err != nil {
+		return nil, fmt.Errorf("decoding created issue: %w", err)
+	}
+
+	issue.RepoOwner = owner
+	issue.RepoName = repo
+
+	c.InvalidateAll() // Invalidate cache after write.
+	return &issue, nil
+}
+
+// ApplyLabel adds a label to an issue.
+func (c *Client) ApplyLabel(ctx context.Context, token, owner, repo string, index int64, labelIDs []int64) error {
+	payload := map[string]interface{}{
+		"labels": labelIDs,
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("marshaling labels: %w", err)
+	}
+
+	path := fmt.Sprintf("/repos/%s/%s/issues/%d/labels", owner, repo, index)
+	resp, err := c.doRequest(ctx, token, http.MethodPost, path, strings.NewReader(string(jsonData)))
+	if err != nil {
+		return fmt.Errorf("applying labels: %w", err)
+	}
+	resp.Body.Close()
+
+	c.InvalidateAll()
+	return nil
+}
+
+// SubmitReview submits a review on a pull request.
+func (c *Client) SubmitReview(ctx context.Context, token, owner, repo string, index int64, reviewType, body string) error {
+	payload := map[string]interface{}{
+		"event": reviewType, // "APPROVED", "REQUEST_CHANGES", "COMMENT"
+		"body":  body,
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("marshaling review: %w", err)
+	}
+
+	path := fmt.Sprintf("/repos/%s/%s/pulls/%d/reviews", owner, repo, index)
+	resp, err := c.doRequest(ctx, token, http.MethodPost, path, strings.NewReader(string(jsonData)))
+	if err != nil {
+		return fmt.Errorf("submitting review: %w", err)
+	}
+	resp.Body.Close()
+
+	c.InvalidateAll()
+	return nil
+}
+
+// CloseIssue closes an issue by setting its state to "closed".
+func (c *Client) CloseIssue(ctx context.Context, token, owner, repo string, index int64) error {
+	return c.SetIssueState(ctx, token, owner, repo, index, "closed")
+}
+
+// SetIssueState sets an issue's state (e.g. "open" or "closed").
+func (c *Client) SetIssueState(ctx context.Context, token, owner, repo string, index int64, state string) error {
+	payload, err := json.Marshal(map[string]string{"state": state})
+	if err != nil {
+		return fmt.Errorf("marshaling state change: %w", err)
+	}
+
+	path := fmt.Sprintf("/repos/%s/%s/issues/%d", owner, repo, index)
+	resp, err := c.doRequest(ctx, token, http.MethodPatch, path, strings.NewReader(string(payload)))
+	if err != nil {
+		return fmt.Errorf("setting issue state: %w", err)
+	}
+	resp.Body.Close()
+
+	c.InvalidateAll()
+	return nil
+}
+
+// AddComment creates a comment on an issue and returns the created Comment.
+func (c *Client) AddComment(ctx context.Context, token, owner, repo string, index int64, body string) (*Comment, error) {
+	return c.PostComment(ctx, token, owner, repo, index, body)
+}
+
+// PostComment creates a comment on an issue and returns the created Comment.
+func (c *Client) PostComment(ctx context.Context, token, owner, repo string, index int64, body string) (*Comment, error) {
+	payload, err := json.Marshal(map[string]string{"body": body})
+	if err != nil {
+		return nil, fmt.Errorf("marshaling comment: %w", err)
+	}
+
+	path := fmt.Sprintf("/repos/%s/%s/issues/%d/comments", owner, repo, index)
+	resp, err := c.doRequest(ctx, token, http.MethodPost, path, strings.NewReader(string(payload)))
+	if err != nil {
+		return nil, fmt.Errorf("posting comment: %w", err)
+	}
+	defer resp.Body.Close()
+
+	var comment Comment
+	if err := json.NewDecoder(resp.Body).Decode(&comment); err != nil {
+		return nil, fmt.Errorf("decoding comment: %w", err)
+	}
+
+	// Populate convenience fields.
+	comment.User = comment.RawUser.Login
+	comment.CreatedAt = comment.RawCreatedAt.Format("Jan 2, 2006 15:04")
+
+	c.InvalidateAll()
+	return &comment, nil
+}
+
+// RenderMarkdown renders raw markdown text to HTML using the Gitea API.
+// Falls back to the raw text if the API call fails.
+func (c *Client) RenderMarkdown(ctx context.Context, token, text string) (string, error) {
+	payload, err := json.Marshal(map[string]string{
+		"Text": text,
+		"Mode": "gfm",
+	})
+	if err != nil {
+		return text, fmt.Errorf("marshaling markdown request: %w", err)
+	}
+
+	url := c.baseURL + "/api/v1/markdown"
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, strings.NewReader(string(payload)))
+	if err != nil {
+		return text, fmt.Errorf("creating markdown request: %w", err)
+	}
+
+	req.Header.Set("Authorization", "token "+token)
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "text/html")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return text, fmt.Errorf("executing markdown request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return text, fmt.Errorf("markdown API error %d", resp.StatusCode)
+	}
+
+	rendered, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return text, fmt.Errorf("reading markdown response: %w", err)
+	}
+
+	return string(rendered), nil
+}
+
+// priorityScore returns a numeric score for sorting (lower = higher priority).
+func priorityScore(labels []string) int {
+	for _, l := range labels {
+		switch l {
+		case "P1":
+			return 1
+		case "P2":
+			return 2
+		case "P3":
+			return 3
+		}
+	}
+	return 4 // no priority label
+}

internal/gitea/client_test.go

@@ -0,0 +1,376 @@
+package gitea
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestNewClient(t *testing.T) {
+	c := NewClient("https://gitea.example.com")
+	if c.baseURL != "https://gitea.example.com" {
+		t.Errorf("baseURL = %q, want %q", c.baseURL, "https://gitea.example.com")
+	}
+	if c.maxConcurrent != 5 {
+		t.Errorf("maxConcurrent = %d, want 5", c.maxConcurrent)
+	}
+	if c.cacheTTL != 30*time.Second {
+		t.Errorf("cacheTTL = %v, want 30s", c.cacheTTL)
+	}
+}
+
+func TestNewClient_TrailingSlash(t *testing.T) {
+	c := NewClient("https://gitea.example.com/")
+	if c.baseURL != "https://gitea.example.com" {
+		t.Errorf("baseURL = %q, want trailing slash removed", c.baseURL)
+	}
+}
+
+func TestCache(t *testing.T) {
+	c := NewClient("https://gitea.example.com")
+
+	// Cache miss.
+	_, ok := c.getFromCache("key1")
+	if ok {
+		t.Error("expected cache miss")
+	}
+
+	// Cache set and hit.
+	c.setCache("key1", "value1")
+	val, ok := c.getFromCache("key1")
+	if !ok {
+		t.Fatal("expected cache hit")
+	}
+	if val.(string) != "value1" {
+		t.Errorf("got %q, want %q", val, "value1")
+	}
+
+	// Invalidate.
+	c.invalidateCache("key")
+	_, ok = c.getFromCache("key1")
+	if ok {
+		t.Error("expected cache miss after invalidation")
+	}
+}
+
+func TestCacheExpiry(t *testing.T) {
+	c := NewClient("https://gitea.example.com")
+	c.cacheTTL = 1 * time.Millisecond
+
+	c.setCache("key1", "value1")
+	time.Sleep(5 * time.Millisecond)
+
+	_, ok := c.getFromCache("key1")
+	if ok {
+		t.Error("expected cache miss after TTL expiry")
+	}
+}
+
+func TestInvalidateAll(t *testing.T) {
+	c := NewClient("https://gitea.example.com")
+	c.setCache("key1", "value1")
+	c.setCache("key2", "value2")
+
+	c.InvalidateAll()
+
+	_, ok1 := c.getFromCache("key1")
+	_, ok2 := c.getFromCache("key2")
+	if ok1 || ok2 {
+		t.Error("expected all cache entries to be invalidated")
+	}
+}
+
+func TestPriorityScore(t *testing.T) {
+	tests := []struct {
+		labels []string
+		want   int
+	}{
+		{[]string{"P1", "bug"}, 1},
+		{[]string{"P2"}, 2},
+		{[]string{"P3", "enhancement"}, 3},
+		{[]string{"bug", "enhancement"}, 4},
+		{nil, 4},
+	}
+
+	for _, tt := range tests {
+		got := priorityScore(tt.labels)
+		if got != tt.want {
+			t.Errorf("priorityScore(%v) = %d, want %d", tt.labels, got, tt.want)
+		}
+	}
+}
+
+func TestListOrgs(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/user/orgs" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+			http.NotFound(w, r)
+			return
+		}
+		if r.Header.Get("Authorization") != "token test-token" {
+			t.Error("missing or wrong Authorization header")
+		}
+
+		orgs := []Org{
+			{Name: "org1", FullName: "Organization 1"},
+			{Name: "org2", FullName: "Organization 2"},
+		}
+		json.NewEncoder(w).Encode(orgs)
+	}))
+	defer server.Close()
+
+	c := NewClient(server.URL)
+	orgs, err := c.ListOrgs(context.Background(), "test-token")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(orgs) != 2 {
+		t.Fatalf("got %d orgs, want 2", len(orgs))
+	}
+	if orgs[0].Name != "org1" {
+		t.Errorf("orgs[0].Name = %q, want %q", orgs[0].Name, "org1")
+	}
+}
+
+func TestListOrgs_Cached(t *testing.T) {
+	callCount := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		callCount++
+		json.NewEncoder(w).Encode([]Org{{Name: "org1"}})
+	}))
+	defer server.Close()
+
+	c := NewClient(server.URL)
+
+	// First call should hit the server.
+	_, err := c.ListOrgs(context.Background(), "test-token")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Second call should use cache.
+	_, err = c.ListOrgs(context.Background(), "test-token")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if callCount != 1 {
+		t.Errorf("server called %d times, want 1 (cached)", callCount)
+	}
+}
+
+func TestListOrgRepos(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		repos := []Repo{
+			{ID: 1, Name: "repo1", FullName: "org1/repo1"},
+			{ID: 2, Name: "repo2", FullName: "org1/repo2"},
+		}
+		json.NewEncoder(w).Encode(repos)
+	}))
+	defer server.Close()
+
+	c := NewClient(server.URL)
+	repos, err := c.ListOrgRepos(context.Background(), "test-token", "org1")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(repos) != 2 {
+		t.Fatalf("got %d repos, want 2", len(repos))
+	}
+}
+
+func TestGetTriageQueue_Sorting(t *testing.T) {
+	queue := []TriageItem{
+		{Title: "low", Labels: []string{"P3"}, UpdatedAt: time.Now()},
+		{Title: "high", Labels: []string{"P1"}, UpdatedAt: time.Now()},
+		{Title: "medium", Labels: []string{"P2"}, UpdatedAt: time.Now()},
+		{Title: "none", Labels: nil, UpdatedAt: time.Now()},
+	}
+
+	// Apply the same sort as GetTriageQueue.
+	sortTriageQueue(queue)
+
+	expected := []string{"high", "medium", "low", "none"}
+	for i, item := range queue {
+		if item.Title != expected[i] {
+			t.Errorf("queue[%d].Title = %q, want %q", i, item.Title, expected[i])
+		}
+	}
+}
+
+func TestCloseIssue(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPatch {
+			t.Errorf("expected PATCH, got %s", r.Method)
+		}
+		if r.URL.Path != "/api/v1/repos/owner1/repo1/issues/42" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+		if r.Header.Get("Authorization") != "token test-token" {
+			t.Error("missing or wrong Authorization header")
+		}
+
+		var body map[string]string
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			t.Fatalf("failed to decode body: %v", err)
+		}
+		if body["state"] != "closed" {
+			t.Errorf("expected state=closed, got %q", body["state"])
+		}
+
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(map[string]string{"state": "closed"})
+	}))
+	defer server.Close()
+
+	c := NewClient(server.URL)
+	c.setCache("issues-org1", "should-be-invalidated")
+
+	err := c.CloseIssue(context.Background(), "test-token", "owner1", "repo1", 42)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Verify cache was invalidated.
+	_, ok := c.getFromCache("issues-org1")
+	if ok {
+		t.Error("expected cache to be invalidated after CloseIssue")
+	}
+}
+
+func TestSetIssueState(t *testing.T) {
+	tests := []struct {
+		name  string
+		state string
+	}{
+		{"close", "closed"},
+		{"reopen", "open"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.Method != http.MethodPatch {
+					t.Errorf("expected PATCH, got %s", r.Method)
+				}
+				if r.URL.Path != "/api/v1/repos/owner1/repo1/issues/42" {
+					t.Errorf("unexpected path: %s", r.URL.Path)
+				}
+
+				var body map[string]string
+				if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+					t.Fatalf("failed to decode body: %v", err)
+				}
+				if body["state"] != tt.state {
+					t.Errorf("expected state=%q, got %q", tt.state, body["state"])
+				}
+
+				w.WriteHeader(http.StatusOK)
+				json.NewEncoder(w).Encode(map[string]string{"state": tt.state})
+			}))
+			defer server.Close()
+
+			c := NewClient(server.URL)
+			c.setCache("issues-org1", "should-be-invalidated")
+
+			err := c.SetIssueState(context.Background(), "test-token", "owner1", "repo1", 42, tt.state)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			_, ok := c.getFromCache("issues-org1")
+			if ok {
+				t.Error("expected cache to be invalidated after SetIssueState")
+			}
+		})
+	}
+}
+
+func TestAddComment(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		comment := map[string]interface{}{
+			"id":         1,
+			"body":       "test",
+			"user":       map[string]string{"login": "testuser"},
+			"created_at": "2026-03-26T12:00:00Z",
+		}
+		json.NewEncoder(w).Encode(comment)
+	}))
+	defer server.Close()
+
+	c := NewClient(server.URL)
+	comment, err := c.AddComment(context.Background(), "test-token", "owner1", "repo1", 42, "test")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if comment.Body != "test" {
+		t.Errorf("comment.Body = %q, want %q", comment.Body, "test")
+	}
+}
+
+func TestPostComment(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Errorf("expected POST, got %s", r.Method)
+		}
+		if r.URL.Path != "/api/v1/repos/owner1/repo1/issues/42/comments" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+		}
+
+		var body map[string]string
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			t.Fatalf("failed to decode body: %v", err)
+		}
+		if body["body"] != "test comment" {
+			t.Errorf("expected body='test comment', got %q", body["body"])
+		}
+
+		comment := map[string]interface{}{
+			"id":   1,
+			"body": body["body"],
+			"user": map[string]string{"login": "testuser"},
+			"created_at": "2026-03-26T12:00:00Z",
+		}
+		json.NewEncoder(w).Encode(comment)
+	}))
+	defer server.Close()
+
+	c := NewClient(server.URL)
+	c.setCache("issues-org1", "should-be-invalidated")
+
+	comment, err := c.PostComment(context.Background(), "test-token", "owner1", "repo1", 42, "test comment")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if comment.Body != "test comment" {
+		t.Errorf("comment.Body = %q, want %q", comment.Body, "test comment")
+	}
+	if comment.User != "testuser" {
+		t.Errorf("comment.User = %q, want %q", comment.User, "testuser")
+	}
+	if comment.ID != 1 {
+		t.Errorf("comment.ID = %d, want 1", comment.ID)
+	}
+
+	// Verify cache was invalidated.
+	_, ok := c.getFromCache("issues-org1")
+	if ok {
+		t.Error("expected cache to be invalidated after PostComment")
+	}
+}
+
+// sortTriageQueue is a test helper applying the same sort as GetTriageQueue.
+func sortTriageQueue(queue []TriageItem) {
+	for i := 0; i < len(queue); i++ {
+		for j := i + 1; j < len(queue); j++ {
+			pi := priorityScore(queue[i].Labels)
+			pj := priorityScore(queue[j].Labels)
+			if pj < pi || (pj == pi && queue[j].UpdatedAt.After(queue[i].UpdatedAt)) {
+				queue[i], queue[j] = queue[j], queue[i]
+			}
+		}
+	}
+}

internal/handlers/handlers.go

@@ -0,0 +1,760 @@
+// Package handlers implements HTTP handlers for the Gitea Mobile application.
+package handlers
+
+import (
+	"fmt"
+	"html/template"
+	"log/slog"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/config"
+	giteaclient "gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/gitea"
+	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/middleware"
+)
+
+// Handler holds shared dependencies for all HTTP handlers.
+type Handler struct {
+	Config *config.Config
+	Client *giteaclient.Client
+}
+
+// NewHandler creates a new Handler with the given config and client.
+func NewHandler(cfg *config.Config, client *giteaclient.Client) *Handler {
+	return &Handler{
+		Config: cfg,
+		Client: client,
+	}
+}
+
+// RegisterRoutes registers all HTTP routes on the given ServeMux.
+func (h *Handler) RegisterRoutes(mux *http.ServeMux) {
+	// Health endpoint.
+	mux.HandleFunc("GET /health", h.Health)
+
+	// Dashboard / triage.
+	mux.HandleFunc("GET /", h.Dashboard)
+
+	// Issues.
+	mux.HandleFunc("GET /issues", h.ListIssues)
+	mux.HandleFunc("GET /issues/new", h.NewIssue)
+	mux.HandleFunc("POST /issues", h.CreateIssue)
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/labels", h.ApplyLabels)
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/close", h.CloseIssue)
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/state", h.SetIssueState)
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/comments", h.AddComment)
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/comment", h.AddComment)
+
+	// Issue detail.
+	mux.HandleFunc("GET /issues/{owner}/{repo}/{index}", h.IssueDetail)
+
+	// Pull requests.
+	mux.HandleFunc("GET /pulls", h.ListPulls)
+	mux.HandleFunc("GET /pulls/{owner}/{repo}/{index}", h.PullDetail)
+	mux.HandleFunc("POST /pulls/{owner}/{repo}/{index}/review", h.SubmitReview)
+
+	// Settings (handled separately for auth bypass).
+	settingsHandler := &SettingsHandler{
+		SessionSecret: h.Config.SessionSecret,
+		SecureCookies: true,
+	}
+	mux.HandleFunc("/settings", settingsHandler.ServeHTTP)
+
+	// Static files.
+	mux.Handle("/static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static"))))
+}
+
+// isHTMX returns true if the request is an HTMX partial request.
+func isHTMX(r *http.Request) bool {
+	return r.Header.Get("HX-Request") == "true"
+}
+
+// getToken extracts the user's Gitea API token from request context.
+func getToken(r *http.Request) string {
+	return middleware.TokenFromContext(r.Context())
+}
+
+// getUserOrgs returns the list of org names the user belongs to.
+func (h *Handler) getUserOrgs(r *http.Request) []string {
+	token := getToken(r)
+	if token == "" {
+		return nil
+	}
+
+	orgs, err := h.Client.ListOrgs(r.Context(), token)
+	if err != nil {
+		slog.Error("failed to list orgs", "error", err)
+		return nil
+	}
+
+	var names []string
+	for _, org := range orgs {
+		names = append(names, org.Name)
+	}
+	return names
+}
+
+// Health handles GET /health for Kubernetes probes.
+func (h *Handler) Health(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusOK)
+	fmt.Fprintln(w, "ok")
+}
+
+// basePage is the full HTML wrapper used for non-HTMX requests.
+var basePage = template.Must(template.New("base").Parse(`<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
+  <meta name="apple-mobile-web-app-capable" content="yes">
+  <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
+  <meta name="theme-color" content="#161b22">
+  <link rel="manifest" href="/static/manifest.json">
+  <link rel="apple-touch-icon" href="/static/icon-192.png">
+  <title>{{.Title}} — Gitea Mobile</title>
+  <link rel="stylesheet" href="/static/style.css">
+  <script src="/static/htmx.min.js"></script>
+</head>
+<body>
+  <div class="content" id="main-content">
+    {{.Content}}
+  </div>
+  <nav class="bottom-nav">
+    <a href="/" {{if eq .ActiveTab "dashboard"}}class="active"{{end}}>
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 9l9-7 9 7v11a2 2 0 01-2 2H5a2 2 0 01-2-2V9z"/></svg>
+      Dashboard
+    </a>
+    <a href="/issues" {{if eq .ActiveTab "issues"}}class="active"{{end}}>
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><line x1="12" y1="8" x2="12" y2="12"/><line x1="12" y1="16" x2="12.01" y2="16"/></svg>
+      Issues
+    </a>
+    <a href="/pulls" {{if eq .ActiveTab "pulls"}}class="active"{{end}}>
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="18" cy="18" r="3"/><circle cx="6" cy="6" r="3"/><path d="M6 21V9a9 9 0 009 9"/></svg>
+      PRs
+    </a>
+    <a href="/settings" {{if eq .ActiveTab "settings"}}class="active"{{end}}>
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 00.33 1.82l.06.06a2 2 0 010 2.83 2 2 0 01-2.83 0l-.06-.06a1.65 1.65 0 00-1.82-.33 1.65 1.65 0 00-1 1.51V21a2 2 0 01-4 0v-.09A1.65 1.65 0 009 19.4a1.65 1.65 0 00-1.82.33l-.06.06a2 2 0 01-2.83-2.83l.06-.06A1.65 1.65 0 004.68 15a1.65 1.65 0 00-1.51-1H3a2 2 0 010-4h.09A1.65 1.65 0 004.6 9a1.65 1.65 0 00-.33-1.82l-.06-.06a2 2 0 012.83-2.83l.06.06A1.65 1.65 0 009 4.68a1.65 1.65 0 001-1.51V3a2 2 0 014 0v.09a1.65 1.65 0 001 1.51 1.65 1.65 0 001.82-.33l.06-.06a2 2 0 012.83 2.83l-.06.06A1.65 1.65 0 0019.4 9a1.65 1.65 0 001.51 1H21a2 2 0 010 4h-.09a1.65 1.65 0 00-1.51 1z"/></svg>
+      Settings
+    </a>
+  </nav>
+  <script>
+    if ('serviceWorker' in navigator) {
+      navigator.serviceWorker.register('/static/sw.js').catch(function(err) {
+        console.log('SW registration failed:', err);
+      });
+    }
+  </script>
+</body>
+</html>`))
+
+type pageData struct {
+	Title     string
+	ActiveTab string
+	Content   template.HTML
+}
+
+// renderPage renders either a full page (for regular requests) or just the
+// content fragment (for HTMX requests).
+func renderPage(w http.ResponseWriter, r *http.Request, title, activeTab string, content string) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+
+	if isHTMX(r) {
+		fmt.Fprint(w, content)
+		return
+	}
+
+	data := pageData{
+		Title:     title,
+		ActiveTab: activeTab,
+		Content:   template.HTML(content),
+	}
+	if err := basePage.Execute(w, data); err != nil {
+		slog.Error("template render error", "error", err)
+	}
+}
+
+// Dashboard handles GET / — the triage queue.
+func (h *Handler) Dashboard(w http.ResponseWriter, r *http.Request) {
+	// Only handle exact root path.
+	if r.URL.Path != "/" {
+		http.NotFound(w, r)
+		return
+	}
+
+	token := getToken(r)
+	orgs := h.getUserOrgs(r)
+
+	type dashboardData struct {
+		Items []giteaclient.TriageItem
+		Error string
+	}
+
+	var data dashboardData
+
+	if len(orgs) == 0 {
+		data.Error = "No organizations found. Check your token permissions."
+	} else {
+		queue, err := h.Client.GetTriageQueue(r.Context(), token, orgs)
+		if err != nil {
+			slog.Error("failed to get triage queue", "error", err)
+			data.Error = "Error loading triage queue."
+		} else {
+			data.Items = queue
+		}
+	}
+
+	tmpl, err := template.ParseFiles("internal/templates/dashboard.html")
+	if err != nil {
+		slog.Error("failed to parse dashboard template", "error", err)
+		http.Error(w, "template error", http.StatusInternalServerError)
+		return
+	}
+
+	var buf strings.Builder
+	if err := tmpl.ExecuteTemplate(&buf, "content", data); err != nil {
+		slog.Error("failed to execute dashboard template", "error", err)
+		http.Error(w, "template error", http.StatusInternalServerError)
+		return
+	}
+
+	renderPage(w, r, "Dashboard", "dashboard", buf.String())
+}
+
+// ListIssues handles GET /issues.
+func (h *Handler) ListIssues(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	orgNames := h.getUserOrgs(r)
+
+	type issuesData struct {
+		Issues        []giteaclient.Issue
+		Orgs          []string
+		SelectedOrg   string
+		SelectedState string
+		HasMore       bool
+		NextPage      int
+		Error         string
+	}
+
+	selectedOrg := r.URL.Query().Get("org")
+	selectedState := r.URL.Query().Get("state")
+	if selectedState == "" {
+		selectedState = "open"
+	}
+
+	data := issuesData{
+		Orgs:          orgNames,
+		SelectedOrg:   selectedOrg,
+		SelectedState: selectedState,
+	}
+
+	if len(orgNames) == 0 {
+		data.Error = "No organizations found."
+	} else {
+		// Filter to selected org if specified.
+		queryOrgs := orgNames
+		if selectedOrg != "" {
+			queryOrgs = []string{selectedOrg}
+		}
+
+		issues, err := h.Client.ListAllIssues(r.Context(), token, queryOrgs)
+		if err != nil {
+			slog.Error("failed to list issues", "error", err)
+			data.Error = "Error loading issues."
+		} else {
+			data.Issues = issues
+		}
+	}
+
+	tmpl, err := template.ParseFiles("internal/templates/issues.html")
+	if err != nil {
+		slog.Error("failed to parse issues template", "error", err)
+		http.Error(w, "template error", http.StatusInternalServerError)
+		return
+	}
+
+	var buf strings.Builder
+	if err := tmpl.ExecuteTemplate(&buf, "content", data); err != nil {
+		slog.Error("failed to execute issues template", "error", err)
+		http.Error(w, "template error", http.StatusInternalServerError)
+		return
+	}
+
+	renderPage(w, r, "Issues", "issues", buf.String())
+}
+
+// ListPulls handles GET /pulls.
+func (h *Handler) ListPulls(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	orgNames := h.getUserOrgs(r)
+
+	type pullsData struct {
+		Pulls       []giteaclient.PullRequest
+		Orgs        []string
+		SelectedOrg string
+		Error       string
+	}
+
+	selectedOrg := r.URL.Query().Get("org")
+
+	data := pullsData{
+		Orgs:        orgNames,
+		SelectedOrg: selectedOrg,
+	}
+
+	if len(orgNames) == 0 {
+		data.Error = "No organizations found."
+	} else {
+		queryOrgs := orgNames
+		if selectedOrg != "" {
+			queryOrgs = []string{selectedOrg}
+		}
+
+		prs, err := h.Client.ListAllPullRequests(r.Context(), token, queryOrgs)
+		if err != nil {
+			slog.Error("failed to list pull requests", "error", err)
+			data.Error = "Error loading pull requests."
+		} else {
+			data.Pulls = prs
+		}
+	}
+
+	tmpl, err := template.ParseFiles("internal/templates/pulls.html")
+	if err != nil {
+		slog.Error("failed to parse pulls template", "error", err)
+		http.Error(w, "template error", http.StatusInternalServerError)
+		return
+	}
+
+	var buf strings.Builder
+	if err := tmpl.ExecuteTemplate(&buf, "content", data); err != nil {
+		slog.Error("failed to execute pulls template", "error", err)
+		http.Error(w, "template error", http.StatusInternalServerError)
+		return
+	}
+
+	renderPage(w, r, "Pull Requests", "pulls", buf.String())
+}
+
+// IssueDetail handles GET /issues/{owner}/{repo}/{index}.
+func (h *Handler) IssueDetail(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	owner := r.PathValue("owner")
+	repo := r.PathValue("repo")
+	indexStr := r.PathValue("index")
+
+	index, err := strconv.ParseInt(indexStr, 10, 64)
+	if err != nil {
+		http.Error(w, "invalid issue index", http.StatusBadRequest)
+		return
+	}
+
+	issue, err := h.Client.GetIssue(r.Context(), token, owner, repo, index)
+	if err != nil {
+		slog.Error("failed to get issue", "error", err, "owner", owner, "repo", repo, "index", index)
+		renderPage(w, r, "Issue Not Found", "issues",
+			`<h1>Issue Not Found</h1><p class="empty">Could not load the requested issue.</p>`)
+		return
+	}
+
+	comments, err := h.Client.GetIssueComments(r.Context(), token, owner, repo, index)
+	if err != nil {
+		slog.Error("failed to get comments", "error", err)
+		comments = nil // non-fatal, render without comments
+	}
+
+	labels, err := h.Client.GetRepoLabels(r.Context(), token, owner, repo)
+	if err != nil {
+		slog.Error("failed to get repo labels", "error", err)
+		labels = nil
+	}
+
+	// Render markdown body if present.
+	var renderedBody template.HTML
+	if issue.Body != "" {
+		rendered, err := h.Client.RenderMarkdown(r.Context(), token, issue.Body)
+		if err != nil {
+			slog.Warn("failed to render issue body markdown, using plain text", "error", err)
+		} else {
+			renderedBody = template.HTML(rendered)
+		}
+	}
+
+	// Build the content HTML using the template.
+	tmpl, err := template.ParseFiles("internal/templates/issue_detail.html")
+	if err != nil {
+		slog.Error("failed to parse issue_detail template", "error", err)
+		http.Error(w, "template error", http.StatusInternalServerError)
+		return
+	}
+
+	type templateData struct {
+		Issue           *giteaclient.Issue
+		RenderedBody    template.HTML
+		Comments        []giteaclient.Comment
+		AvailableLabels []giteaclient.Label
+	}
+
+	data := templateData{
+		Issue:           issue,
+		RenderedBody:    renderedBody,
+		Comments:        comments,
+		AvailableLabels: labels,
+	}
+
+	var buf strings.Builder
+	if err := tmpl.ExecuteTemplate(&buf, "content", data); err != nil {
+		slog.Error("failed to execute issue_detail template", "error", err)
+		http.Error(w, "template error", http.StatusInternalServerError)
+		return
+	}
+
+	renderPage(w, r, fmt.Sprintf("Issue #%d", index), "issues", buf.String())
+}
+
+// PullDetail handles GET /pulls/{owner}/{repo}/{index}.
+func (h *Handler) PullDetail(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	owner := r.PathValue("owner")
+	repo := r.PathValue("repo")
+	indexStr := r.PathValue("index")
+
+	index, err := strconv.ParseInt(indexStr, 10, 64)
+	if err != nil {
+		http.Error(w, "invalid PR index", http.StatusBadRequest)
+		return
+	}
+
+	pr, err := h.Client.GetPull(r.Context(), token, owner, repo, index)
+	if err != nil {
+		slog.Error("failed to get pull request", "error", err, "owner", owner, "repo", repo, "index", index)
+		renderPage(w, r, "PR Not Found", "pulls",
+			`<h1>Pull Request Not Found</h1><p class="empty">Could not load the requested pull request.</p>`)
+		return
+	}
+
+	// Render markdown body if present.
+	var renderedBody template.HTML
+	if pr.Body != "" {
+		rendered, err := h.Client.RenderMarkdown(r.Context(), token, pr.Body)
+		if err != nil {
+			slog.Warn("failed to render PR body markdown, using plain text", "error", err)
+		} else {
+			renderedBody = template.HTML(rendered)
+		}
+	}
+
+	// Build the content HTML using the template.
+	tmpl, err := template.ParseFiles("internal/templates/pull_detail.html")
+	if err != nil {
+		slog.Error("failed to parse pull_detail template", "error", err)
+		http.Error(w, "template error", http.StatusInternalServerError)
+		return
+	}
+
+	type templateData struct {
+		Pull         *giteaclient.PullRequest
+		RenderedBody template.HTML
+	}
+
+	data := templateData{
+		Pull:         pr,
+		RenderedBody: renderedBody,
+	}
+
+	var buf strings.Builder
+	if err := tmpl.ExecuteTemplate(&buf, "content", data); err != nil {
+		slog.Error("failed to execute pull_detail template", "error", err)
+		http.Error(w, "template error", http.StatusInternalServerError)
+		return
+	}
+
+	renderPage(w, r, fmt.Sprintf("PR #%d", index), "pulls", buf.String())
+}
+
+// NewIssue handles GET /issues/new — renders the create-issue form.
+func (h *Handler) NewIssue(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+
+	repos, err := h.Client.ListOrgsAndRepos(r.Context(), token)
+	if err != nil {
+		slog.Error("failed to list repos for new issue form", "error", err)
+		renderPage(w, r, "New Issue", "issues",
+			`<h1>New Issue</h1><p class="empty">Error loading repositories.</p>`)
+		return
+	}
+
+	tmpl, err := template.ParseFiles("internal/templates/create_issue.html")
+	if err != nil {
+		slog.Error("failed to parse create_issue template", "error", err)
+		http.Error(w, "template error", http.StatusInternalServerError)
+		return
+	}
+
+	type templateData struct {
+		Repos map[string][]giteaclient.Repo
+	}
+
+	data := templateData{Repos: repos}
+
+	var buf strings.Builder
+	if err := tmpl.ExecuteTemplate(&buf, "content", data); err != nil {
+		slog.Error("failed to execute create_issue template", "error", err)
+		http.Error(w, "template error", http.StatusInternalServerError)
+		return
+	}
+
+	renderPage(w, r, "New Issue", "issues", buf.String())
+}
+
+// CreateIssue handles POST /issues.
+func (h *Handler) CreateIssue(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+
+	owner := r.FormValue("owner")
+	repo := r.FormValue("repo")
+	title := r.FormValue("title")
+	body := r.FormValue("body")
+
+	if owner == "" || repo == "" || title == "" {
+		if isHTMX(r) {
+			w.Header().Set("Content-Type", "text/html; charset=utf-8")
+			w.WriteHeader(http.StatusBadRequest)
+			fmt.Fprint(w, `<span class="empty">owner, repo, and title are required</span>`)
+			return
+		}
+		http.Error(w, "owner, repo, and title are required", http.StatusBadRequest)
+		return
+	}
+
+	issue, err := h.Client.CreateIssue(r.Context(), token, owner, repo, title, body, nil)
+	if err != nil {
+		slog.Error("failed to create issue", "error", err)
+		if isHTMX(r) {
+			w.Header().Set("Content-Type", "text/html; charset=utf-8")
+			w.WriteHeader(http.StatusInternalServerError)
+			fmt.Fprint(w, `<span class="empty">Failed to create issue. Please try again.</span>`)
+			return
+		}
+		http.Error(w, "failed to create issue", http.StatusInternalServerError)
+		return
+	}
+
+	if isHTMX(r) {
+		w.Header().Set("HX-Redirect", fmt.Sprintf("/issues/%s/%s/%d", owner, repo, issue.Number))
+		w.WriteHeader(http.StatusOK)
+		return
+	}
+
+	http.Redirect(w, r, fmt.Sprintf("/issues/%s/%s/%d", owner, repo, issue.Number), http.StatusSeeOther)
+}
+
+// ApplyLabels handles POST /issues/{owner}/{repo}/{index}/labels.
+func (h *Handler) ApplyLabels(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	owner := r.PathValue("owner")
+	repo := r.PathValue("repo")
+	indexStr := r.PathValue("index")
+
+	index, err := strconv.ParseInt(indexStr, 10, 64)
+	if err != nil {
+		http.Error(w, "invalid issue index", http.StatusBadRequest)
+		return
+	}
+
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+
+	var labelIDs []int64
+	for _, idStr := range r.Form["label_id"] {
+		id, err := strconv.ParseInt(idStr, 10, 64)
+		if err != nil {
+			continue
+		}
+		labelIDs = append(labelIDs, id)
+	}
+
+	if len(labelIDs) == 0 {
+		http.Error(w, "no labels specified", http.StatusBadRequest)
+		return
+	}
+
+	if err := h.Client.ApplyLabel(r.Context(), token, owner, repo, index, labelIDs); err != nil {
+		slog.Error("failed to apply labels", "error", err, "owner", owner, "repo", repo, "index", index)
+		http.Error(w, "failed to apply labels", http.StatusInternalServerError)
+		return
+	}
+
+	if isHTMX(r) {
+		w.WriteHeader(http.StatusOK)
+		fmt.Fprint(w, `<span style="color:#3fb950">Labels applied</span>`)
+		return
+	}
+
+	http.Redirect(w, r, fmt.Sprintf("/issues/%s/%s/%d", owner, repo, index), http.StatusSeeOther)
+}
+
+// CloseIssue handles POST /issues/{owner}/{repo}/{index}/close.
+func (h *Handler) CloseIssue(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	owner := r.PathValue("owner")
+	repo := r.PathValue("repo")
+	indexStr := r.PathValue("index")
+
+	index, err := strconv.ParseInt(indexStr, 10, 64)
+	if err != nil {
+		http.Error(w, "invalid issue index", http.StatusBadRequest)
+		return
+	}
+
+	if err := h.Client.CloseIssue(r.Context(), token, owner, repo, index); err != nil {
+		slog.Error("failed to close issue", "error", err, "owner", owner, "repo", repo, "index", index)
+		http.Error(w, "failed to close issue", http.StatusInternalServerError)
+		return
+	}
+
+	if isHTMX(r) {
+		w.Header().Set("HX-Redirect", fmt.Sprintf("/issues/%s/%s/%d", owner, repo, index))
+		w.WriteHeader(http.StatusOK)
+		return
+	}
+
+	http.Redirect(w, r, fmt.Sprintf("/issues/%s/%s/%d", owner, repo, index), http.StatusSeeOther)
+}
+
+// SetIssueState handles POST /issues/{owner}/{repo}/{index}/state.
+func (h *Handler) SetIssueState(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	owner := r.PathValue("owner")
+	repo := r.PathValue("repo")
+	indexStr := r.PathValue("index")
+
+	index, err := strconv.ParseInt(indexStr, 10, 64)
+	if err != nil {
+		http.Error(w, "invalid issue index", http.StatusBadRequest)
+		return
+	}
+
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+
+	state := r.FormValue("state")
+	if state != "open" && state != "closed" {
+		http.Error(w, "state must be 'open' or 'closed'", http.StatusBadRequest)
+		return
+	}
+
+	if err := h.Client.SetIssueState(r.Context(), token, owner, repo, index, state); err != nil {
+		slog.Error("failed to set issue state", "error", err, "owner", owner, "repo", repo, "index", index, "state", state)
+		http.Error(w, "failed to update issue state", http.StatusInternalServerError)
+		return
+	}
+
+	if isHTMX(r) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		if state == "closed" {
+			fmt.Fprintf(w, `<span class="state-closed" id="issue-state">closed</span>
+<button class="btn btn-secondary" hx-post="/issues/%s/%s/%d/state" hx-vals='{"state":"open"}' hx-target="#state-section" hx-swap="innerHTML">Reopen Issue</button>`,
+				template.HTMLEscapeString(owner), template.HTMLEscapeString(repo), index)
+		} else {
+			fmt.Fprintf(w, `<span class="state-open" id="issue-state">open</span>
+<button class="btn btn-danger" hx-post="/issues/%s/%s/%d/state" hx-vals='{"state":"closed"}' hx-target="#state-section" hx-swap="innerHTML">Close Issue</button>`,
+				template.HTMLEscapeString(owner), template.HTMLEscapeString(repo), index)
+		}
+		return
+	}
+
+	http.Redirect(w, r, fmt.Sprintf("/issues/%s/%s/%d", owner, repo, index), http.StatusSeeOther)
+}
+
+// AddComment handles POST /issues/{owner}/{repo}/{index}/comment.
+func (h *Handler) AddComment(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	owner := r.PathValue("owner")
+	repo := r.PathValue("repo")
+	indexStr := r.PathValue("index")
+
+	index, err := strconv.ParseInt(indexStr, 10, 64)
+	if err != nil {
+		http.Error(w, "invalid issue index", http.StatusBadRequest)
+		return
+	}
+
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+
+	body := r.FormValue("body")
+	if body == "" {
+		http.Error(w, "comment body is required", http.StatusBadRequest)
+		return
+	}
+
+	comment, err := h.Client.PostComment(r.Context(), token, owner, repo, index, body)
+	if err != nil {
+		slog.Error("failed to post comment", "error", err, "owner", owner, "repo", repo, "index", index)
+		http.Error(w, "failed to post comment", http.StatusInternalServerError)
+		return
+	}
+
+	if isHTMX(r) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		fmt.Fprintf(w, `<div class="card comment">
+  <div class="card-meta">%s &middot; %s</div>
+  <div class="card-body">%s</div>
+</div>`, template.HTMLEscapeString(comment.User), template.HTMLEscapeString(comment.CreatedAt), template.HTMLEscapeString(comment.Body))
+		return
+	}
+
+	http.Redirect(w, r, fmt.Sprintf("/issues/%s/%s/%d", owner, repo, index), http.StatusSeeOther)
+}
+
+// SubmitReview handles POST /pulls/{owner}/{repo}/{index}/review.
+func (h *Handler) SubmitReview(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	owner := r.PathValue("owner")
+	repo := r.PathValue("repo")
+	indexStr := r.PathValue("index")
+
+	index, err := strconv.ParseInt(indexStr, 10, 64)
+	if err != nil {
+		http.Error(w, "invalid PR index", http.StatusBadRequest)
+		return
+	}
+
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+
+	reviewType := r.FormValue("event") // APPROVED, REQUEST_CHANGES, COMMENT
+	body := r.FormValue("body")
+
+	if reviewType == "" {
+		http.Error(w, "review event type is required", http.StatusBadRequest)
+		return
+	}
+
+	if err := h.Client.SubmitReview(r.Context(), token, owner, repo, index, reviewType, body); err != nil {
+		slog.Error("failed to submit review", "error", err, "owner", owner, "repo", repo, "index", index)
+		http.Error(w, "failed to submit review", http.StatusInternalServerError)
+		return
+	}
+
+	if isHTMX(r) {
+		w.WriteHeader(http.StatusOK)
+		fmt.Fprint(w, `<span style="color:#3fb950">Review submitted</span>`)
+		return
+	}
+
+	http.Redirect(w, r, fmt.Sprintf("/pulls/%s/%s/%d", owner, repo, index), http.StatusSeeOther)
+}

internal/handlers/handlers_test.go

@@ -0,0 +1,197 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/config"
+	giteaclient "gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/gitea"
+)
+
+func newTestHandler() *Handler {
+	cfg := &config.Config{
+		GiteaURL:      "https://gitea.example.com",
+		SessionSecret: "test-secret-that-is-at-least-32-chars-long",
+		ListenAddr:    ":8080",
+	}
+	client := giteaclient.NewClient(cfg.GiteaURL)
+	return NewHandler(cfg, client)
+}
+
+func TestHealth(t *testing.T) {
+	h := newTestHandler()
+	req := httptest.NewRequest(http.MethodGet, "/health", nil)
+	w := httptest.NewRecorder()
+
+	h.Health(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusOK)
+	}
+	if body := w.Body.String(); body != "ok\n" {
+		t.Errorf("body = %q, want %q", body, "ok\n")
+	}
+}
+
+func TestDashboard_NoToken(t *testing.T) {
+	h := newTestHandler()
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	w := httptest.NewRecorder()
+
+	h.Dashboard(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusOK)
+	}
+	// Without a token in context, should show "No organizations found."
+	if body := w.Body.String(); body == "" {
+		t.Error("expected non-empty response body")
+	}
+}
+
+func TestDashboard_HTMX(t *testing.T) {
+	h := newTestHandler()
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("HX-Request", "true")
+	w := httptest.NewRecorder()
+
+	h.Dashboard(w, req)
+
+	// HTMX request should not include full HTML page wrapper.
+	body := w.Body.String()
+	if body == "" {
+		t.Error("expected non-empty response body")
+	}
+	// Should NOT contain DOCTYPE for HTMX fragment.
+	if contains(body, "<!DOCTYPE") {
+		t.Error("HTMX response should not contain DOCTYPE")
+	}
+}
+
+func TestIsHTMX(t *testing.T) {
+	tests := []struct {
+		header string
+		want   bool
+	}{
+		{"true", true},
+		{"false", false},
+		{"", false},
+	}
+
+	for _, tt := range tests {
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		if tt.header != "" {
+			req.Header.Set("HX-Request", tt.header)
+		}
+		if got := isHTMX(req); got != tt.want {
+			t.Errorf("isHTMX(HX-Request=%q) = %v, want %v", tt.header, got, tt.want)
+		}
+	}
+}
+
+func TestCreateIssue_MissingFields(t *testing.T) {
+	h := newTestHandler()
+	req := httptest.NewRequest(http.MethodPost, "/issues", nil)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	h.CreateIssue(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
+
+func TestApplyLabels_InvalidIndex(t *testing.T) {
+	h := newTestHandler()
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/labels", h.ApplyLabels)
+
+	req := httptest.NewRequest(http.MethodPost, "/issues/org/repo/abc/labels", nil)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	mux.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
+
+func TestSubmitReview_MissingEventType(t *testing.T) {
+	h := newTestHandler()
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /pulls/{owner}/{repo}/{index}/review", h.SubmitReview)
+
+	req := httptest.NewRequest(http.MethodPost, "/pulls/org/repo/1/review", nil)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	mux.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
+
+func TestSetIssueState_InvalidState(t *testing.T) {
+	h := newTestHandler()
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/state", h.SetIssueState)
+
+	req := httptest.NewRequest(http.MethodPost, "/issues/org/repo/1/state", nil)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	mux.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
+
+func TestSetIssueState_InvalidIndex(t *testing.T) {
+	h := newTestHandler()
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/state", h.SetIssueState)
+
+	req := httptest.NewRequest(http.MethodPost, "/issues/org/repo/abc/state", nil)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	mux.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
+
+func TestAddComment_EmptyBody(t *testing.T) {
+	h := newTestHandler()
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/comments", h.AddComment)
+
+	req := httptest.NewRequest(http.MethodPost, "/issues/org/repo/1/comments", nil)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	mux.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
+
+func contains(s, substr string) bool {
+	return len(s) >= len(substr) && searchString(s, substr)
+}
+
+func searchString(s, substr string) bool {
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return true
+		}
+	}
+	return false
+}

internal/templates/create_issue.html

@@ -0,0 +1,76 @@
+{{define "content"}}
+<h1>Create Issue</h1>
+
+<div id="form-error" class="empty" style="display:none;"></div>
+
+<form id="create-issue-form" hx-post="/issues" hx-swap="innerHTML" hx-target="#main-content">
+  <div class="form-group">
+    <label for="repo-select">Repository</label>
+    <select id="repo-select" name="owner_repo" required>
+      <option value="">Select a repository...</option>
+      {{range $org, $repos := .Repos}}
+      <optgroup label="{{$org}}">
+        {{range $repos}}
+        <option value="{{.Owner.Login}}/{{.Name}}">{{.FullName}}</option>
+        {{end}}
+      </optgroup>
+      {{end}}
+    </select>
+    <input type="hidden" name="owner" id="owner-input">
+    <input type="hidden" name="repo" id="repo-input">
+  </div>
+
+  <div class="form-group">
+    <label for="title">Title</label>
+    <input type="text" id="title" name="title" placeholder="Issue title" required>
+  </div>
+
+  <div class="form-group">
+    <label for="body">Description</label>
+    <textarea id="body" name="body" placeholder="Describe the issue..."></textarea>
+  </div>
+
+  <button type="submit" class="btn btn-primary">Create Issue</button>
+</form>
+
+<script>
+  (function() {
+    var repoSelect = document.getElementById('repo-select');
+    var ownerInput = document.getElementById('owner-input');
+    var repoInput = document.getElementById('repo-input');
+    var formError = document.getElementById('form-error');
+
+    function splitOwnerRepo() {
+      var val = repoSelect.value;
+      if (val) {
+        var parts = val.split('/');
+        ownerInput.value = parts[0] || '';
+        repoInput.value = parts[1] || '';
+      } else {
+        ownerInput.value = '';
+        repoInput.value = '';
+      }
+    }
+
+    repoSelect.addEventListener('change', splitOwnerRepo);
+
+    // Validate before HTMX submit.
+    document.getElementById('create-issue-form').addEventListener('htmx:configRequest', function(evt) {
+      splitOwnerRepo();
+      if (!ownerInput.value || !repoInput.value) {
+        evt.preventDefault();
+        formError.textContent = 'Please select a repository before submitting.';
+        formError.style.display = 'block';
+        return false;
+      }
+      formError.style.display = 'none';
+    });
+
+    // Show server-side errors inline on HTMX error responses.
+    document.getElementById('create-issue-form').addEventListener('htmx:responseError', function(evt) {
+      formError.textContent = evt.detail.xhr.responseText || 'An error occurred. Please try again.';
+      formError.style.display = 'block';
+    });
+  })();
+</script>
+{{end}}

internal/templates/dashboard.html

@@ -0,0 +1,26 @@
+{{define "content"}}
+<h1>Dashboard</h1>
+
+{{if .Error}}
+<p class="empty">{{.Error}}</p>
+{{else if not .Items}}
+<p class="empty">No items need attention. Nice work!</p>
+{{else}}
+<div class="card-grid">
+  {{range .Items}}
+  <div class="card" hx-get="/{{if eq .Type "pull"}}pulls{{else}}issues{{end}}/{{.RepoOwner}}/{{.RepoName}}/{{.Number}}" hx-target="#main-content" hx-swap="innerHTML" hx-push-url="true">
+    <div class="card-title">
+      {{if eq .Type "pull"}}<span class="type-badge type-pull">PR</span>{{else}}<span class="type-badge type-issue">issue</span>{{end}}
+      {{.Title}}
+    </div>
+    <div class="card-meta">
+      <span>{{.RepoOwner}}/{{.RepoName}} #{{.Number}}</span>
+      {{range .Labels}}
+      <span class="label">{{.}}</span>
+      {{end}}
+    </div>
+  </div>
+  {{end}}
+</div>
+{{end}}
+{{end}}

internal/templates/issue_detail.html

@@ -0,0 +1,65 @@
+{{define "content"}}
+<h1>{{.Issue.Title}}</h1>
+
+<div class="card">
+  <div class="card-meta">
+    <span id="state-section">
+      {{if eq .Issue.State "closed"}}
+      <span class="state-closed" id="issue-state">{{.Issue.State}}</span>
+      <button class="btn btn-secondary" hx-post="/issues/{{.Issue.RepoOwner}}/{{.Issue.RepoName}}/{{.Issue.Number}}/state" hx-vals='{"state":"open"}' hx-target="#state-section" hx-swap="innerHTML">Reopen Issue</button>
+      {{else}}
+      <span class="state-open" id="issue-state">{{.Issue.State}}</span>
+      <button class="btn btn-danger" hx-post="/issues/{{.Issue.RepoOwner}}/{{.Issue.RepoName}}/{{.Issue.Number}}/state" hx-vals='{"state":"closed"}' hx-target="#state-section" hx-swap="innerHTML">Close Issue</button>
+      {{end}}
+    </span>
+    <span>{{.Issue.RepoOwner}}/{{.Issue.RepoName}} #{{.Issue.Number}}</span>
+    {{range .Issue.Labels}}
+    <span class="label" style="color:#{{.Color}};border:1px solid #{{.Color}}">{{.Name}}</span>
+    {{end}}
+  </div>
+  {{if .RenderedBody}}
+  <div class="card-body markdown-body">{{.RenderedBody}}</div>
+  {{else if .Issue.Body}}
+  <div class="card-body">{{.Issue.Body}}</div>
+  {{end}}
+</div>
+
+{{if .Comments}}
+<h2>Comments</h2>
+<div id="comments-list">
+{{range .Comments}}
+<div class="comment">
+  <div class="comment-header">
+    <strong>{{.User}}</strong>
+    <span>{{.CreatedAt}}</span>
+  </div>
+  <div class="comment-body">{{.Body}}</div>
+</div>
+{{end}}
+</div>
+{{else}}
+<div id="comments-list"></div>
+{{end}}
+
+<div class="card" style="margin-top:1rem;">
+  <h2>Add Comment</h2>
+  <form hx-post="/issues/{{.Issue.RepoOwner}}/{{.Issue.RepoName}}/{{.Issue.Number}}/comments" hx-target="#comments-list" hx-swap="beforeend" hx-on::after-request="if(event.detail.successful) this.reset()">
+    <textarea name="body" rows="4" placeholder="Write a comment..." required style="width:100%;margin-bottom:0.5rem;"></textarea>
+    <button type="submit" class="btn btn-primary" style="width:auto;padding:0.5rem 1rem;">Comment</button>
+  </form>
+</div>
+
+<div class="card" style="margin-top:1rem;">
+  <h2>Actions</h2>
+  <form hx-post="/issues/{{.Issue.RepoOwner}}/{{.Issue.RepoName}}/{{.Issue.Number}}/labels" hx-swap="outerHTML" style="margin-bottom:0.5rem;">
+    <div class="filter-bar" style="margin-bottom:0.5rem;">
+      <select name="label_id">
+        {{range .AvailableLabels}}
+        <option value="{{.ID}}">{{.Name}}</option>
+        {{end}}
+      </select>
+      <button type="submit" class="btn btn-secondary" style="width:auto;padding:0.5rem 1rem;">Apply Label</button>
+    </div>
+  </form>
+</div>
+{{end}}

internal/templates/issues.html

@@ -0,0 +1,44 @@
+{{define "content"}}
+<h1>Issues</h1>
+
+<div class="filter-bar">
+  <select name="org" hx-get="/issues" hx-trigger="change" hx-target="#main-content" hx-swap="innerHTML" hx-push-url="true" hx-include="[name='state']">
+    <option value="">All orgs</option>
+    {{range .Orgs}}
+    <option value="{{.}}" {{if eq . $.SelectedOrg}}selected{{end}}>{{.}}</option>
+    {{end}}
+  </select>
+  <select name="state" hx-get="/issues" hx-trigger="change" hx-target="#main-content" hx-swap="innerHTML" hx-push-url="true" hx-include="[name='org']">
+    <option value="open" {{if eq .SelectedState "open"}}selected{{end}}>Open</option>
+    <option value="closed" {{if eq .SelectedState "closed"}}selected{{end}}>Closed</option>
+  </select>
+</div>
+
+{{if .Error}}
+<p class="empty">{{.Error}}</p>
+{{else if not .Issues}}
+<p class="empty">No issues found.</p>
+{{else}}
+<div id="issue-list">
+  {{range .Issues}}
+  <div class="card" hx-get="/issues/{{.RepoOwner}}/{{.RepoName}}/{{.Number}}" hx-target="#main-content" hx-swap="innerHTML" hx-push-url="true">
+    <div class="card-title">{{.Title}}</div>
+    <div class="card-meta">
+      <span>{{.RepoOwner}}/{{.RepoName}} #{{.Number}}</span>
+      {{range .Labels}}
+      <span class="label" style="color:#{{.Color}};border:1px solid #{{.Color}}">{{.Name}}</span>
+      {{end}}
+      {{if .Assignee}}
+      <span>{{.Assignee.Login}}</span>
+      {{end}}
+    </div>
+  </div>
+  {{end}}
+  {{if .HasMore}}
+  <div class="scroll-sentinel" hx-get="/issues?page={{.NextPage}}&org={{.SelectedOrg}}&state={{.SelectedState}}" hx-trigger="revealed" hx-swap="outerHTML" hx-target="this">
+    <div class="spinner htmx-indicator"></div>
+  </div>
+  {{end}}
+</div>
+{{end}}
+{{end}}

internal/templates/layout.html

@@ -0,0 +1,45 @@
+{{define "layout"}}<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
+  <meta name="apple-mobile-web-app-capable" content="yes">
+  <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
+  <meta name="theme-color" content="#161b22">
+  <link rel="manifest" href="/static/manifest.json">
+  <link rel="apple-touch-icon" href="/static/icon-192.png">
+  <title>{{.Title}} — Gitea Mobile</title>
+  <link rel="stylesheet" href="/static/style.css">
+  <script src="/static/htmx.min.js"></script>
+</head>
+<body>
+  <div class="content" id="main-content">
+    {{template "content" .}}
+  </div>
+  <nav class="bottom-nav">
+    <a href="/" {{if eq .ActiveTab "dashboard"}}class="active"{{end}}>
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 9l9-7 9 7v11a2 2 0 01-2 2H5a2 2 0 01-2-2V9z"/></svg>
+      Dashboard
+    </a>
+    <a href="/issues" {{if eq .ActiveTab "issues"}}class="active"{{end}}>
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><line x1="12" y1="8" x2="12" y2="12"/><line x1="12" y1="16" x2="12.01" y2="16"/></svg>
+      Issues
+    </a>
+    <a href="/pulls" {{if eq .ActiveTab "pulls"}}class="active"{{end}}>
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="18" cy="18" r="3"/><circle cx="6" cy="6" r="3"/><path d="M6 21V9a9 9 0 009 9"/></svg>
+      PRs
+    </a>
+    <a href="/settings" {{if eq .ActiveTab "settings"}}class="active"{{end}}>
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 00.33 1.82l.06.06a2 2 0 010 2.83 2 2 0 01-2.83 0l-.06-.06a1.65 1.65 0 00-1.82-.33 1.65 1.65 0 00-1 1.51V21a2 2 0 01-4 0v-.09A1.65 1.65 0 009 19.4a1.65 1.65 0 00-1.82.33l-.06.06a2 2 0 01-2.83-2.83l.06-.06A1.65 1.65 0 004.68 15a1.65 1.65 0 00-1.51-1H3a2 2 0 010-4h.09A1.65 1.65 0 004.6 9a1.65 1.65 0 00-.33-1.82l-.06-.06a2 2 0 012.83-2.83l.06.06A1.65 1.65 0 009 4.68a1.65 1.65 0 001-1.51V3a2 2 0 014 0v.09a1.65 1.65 0 001 1.51 1.65 1.65 0 001.82-.33l.06-.06a2 2 0 012.83 2.83l-.06.06A1.65 1.65 0 0019.4 9a1.65 1.65 0 001.51 1H21a2 2 0 010 4h-.09a1.65 1.65 0 00-1.51 1z"/></svg>
+      Settings
+    </a>
+  </nav>
+  <script>
+    if ('serviceWorker' in navigator) {
+      navigator.serviceWorker.register('/static/sw.js').catch(function(err) {
+        console.log('SW registration failed:', err);
+      });
+    }
+  </script>
+</body>
+</html>{{end}}

internal/templates/pull_detail.html

@@ -0,0 +1,49 @@
+{{define "content"}}
+<h1>{{.Pull.Title}}</h1>
+
+<div class="card">
+  <div class="card-meta">
+    <span class="type-badge type-pull">PR</span>
+    <span class="state-open">{{.Pull.State}}</span>
+    <span>{{.Pull.RepoOwner}}/{{.Pull.RepoName}} #{{.Pull.Number}}</span>
+    {{range .Pull.Labels}}
+    <span class="label" style="color:#{{.Color}};border:1px solid #{{.Color}}">{{.Name}}</span>
+    {{end}}
+  </div>
+  <div class="card-meta" style="margin-top:0.5rem;">
+    <span class="diff-add">+{{.Pull.Additions}}</span>
+    <span class="diff-del">-{{.Pull.Deletions}}</span>
+    {{if .Pull.Mergeable}}<span style="color:var(--accent-green);">Mergeable</span>{{end}}
+  </div>
+  {{if .RenderedBody}}
+  <div class="card-body markdown-body">{{.RenderedBody}}</div>
+  {{else if .Pull.Body}}
+  <div class="card-body">{{.Pull.Body}}</div>
+  {{end}}
+</div>
+
+<div class="card" style="margin-top:1rem;">
+  <h2>Submit Review</h2>
+  <form hx-post="/pulls/{{.Pull.RepoOwner}}/{{.Pull.RepoName}}/{{.Pull.Number}}/review" hx-swap="outerHTML">
+    <div class="form-group">
+      <label for="review-body">Comment</label>
+      <textarea id="review-body" name="body" placeholder="Leave a review comment..."></textarea>
+    </div>
+    <div class="review-options">
+      <label class="review-option">
+        <input type="radio" name="event" value="COMMENT" checked>
+        <span>Comment</span>
+      </label>
+      <label class="review-option">
+        <input type="radio" name="event" value="APPROVED">
+        <span>Approve</span>
+      </label>
+      <label class="review-option">
+        <input type="radio" name="event" value="REQUEST_CHANGES">
+        <span>Request Changes</span>
+      </label>
+    </div>
+    <button type="submit" class="btn btn-primary">Submit Review</button>
+  </form>
+</div>
+{{end}}

internal/templates/pulls.html

@@ -0,0 +1,38 @@
+{{define "content"}}
+<h1>Pull Requests</h1>
+
+<div class="filter-bar">
+  <select name="org" hx-get="/pulls" hx-trigger="change" hx-target="#main-content" hx-swap="innerHTML" hx-push-url="true">
+    <option value="">All orgs</option>
+    {{range .Orgs}}
+    <option value="{{.}}" {{if eq . $.SelectedOrg}}selected{{end}}>{{.}}</option>
+    {{end}}
+  </select>
+</div>
+
+{{if .Error}}
+<p class="empty">{{.Error}}</p>
+{{else if not .Pulls}}
+<p class="empty">No open pull requests found.</p>
+{{else}}
+<div id="pull-list">
+  {{range .Pulls}}
+  <div class="card" hx-get="/pulls/{{.RepoOwner}}/{{.RepoName}}/{{.Number}}" hx-target="#main-content" hx-swap="innerHTML" hx-push-url="true">
+    <div class="card-title">
+      <span class="type-badge type-pull">PR</span>
+      {{.Title}}
+    </div>
+    <div class="card-meta">
+      <span>{{.RepoOwner}}/{{.RepoName}} #{{.Number}}</span>
+      {{range .Labels}}
+      <span class="label" style="color:#{{.Color}};border:1px solid #{{.Color}}">{{.Name}}</span>
+      {{end}}
+      <span class="diff-add">+{{.Additions}}</span>
+      <span class="diff-del">-{{.Deletions}}</span>
+      {{if .Mergeable}}<span style="color:var(--accent-green);font-size:0.7rem;">mergeable</span>{{end}}
+    </div>
+  </div>
+  {{end}}
+</div>
+{{end}}
+{{end}}

static/manifest.json

@@ -0,0 +1,24 @@
+{
+  "name": "Gitea Mobile",
+  "short_name": "Gitea",
+  "description": "Mobile-first PWA for managing Gitea issues and pull requests",
+  "start_url": "/",
+  "display": "standalone",
+  "background_color": "#0d1117",
+  "theme_color": "#161b22",
+  "orientation": "portrait",
+  "icons": [
+    {
+      "src": "/static/icon-192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "any maskable"
+    },
+    {
+      "src": "/static/icon-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any maskable"
+    }
+  ]
+}

static/style.css

@@ -0,0 +1,477 @@
+/* Gitea Mobile — Mobile-first CSS (~5KB target) */
+
+/* Reset */
+*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+
+/* CSS Variables */
+:root {
+  --bg-primary: #0d1117;
+  --bg-secondary: #161b22;
+  --bg-tertiary: #21262d;
+  --border: #30363d;
+  --text-primary: #e6edf3;
+  --text-secondary: #8b949e;
+  --text-link: #58a6ff;
+  --accent-green: #3fb950;
+  --accent-red: #f85149;
+  --accent-yellow: #d29922;
+  --accent-blue: #58a6ff;
+  --accent-purple: #bc8cff;
+  --spacing-xs: 0.25rem;
+  --spacing-sm: 0.5rem;
+  --spacing-md: 0.75rem;
+  --spacing-lg: 1rem;
+  --radius: 8px;
+  --radius-sm: 6px;
+  --radius-pill: 10px;
+  --nav-height: 56px;
+  --font-sm: 0.75rem;
+  --font-base: 0.875rem;
+  --font-lg: 1rem;
+  --font-xl: 1.25rem;
+}
+
+/* Base */
+html {
+  font-size: 16px;
+  -webkit-text-size-adjust: 100%;
+}
+
+body {
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+  background: var(--bg-primary);
+  color: var(--text-primary);
+  line-height: 1.5;
+  padding-bottom: calc(var(--nav-height) + env(safe-area-inset-bottom));
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+/* Content area */
+.content {
+  padding: var(--spacing-lg);
+  padding-top: max(var(--spacing-lg), env(safe-area-inset-top));
+  max-width: 640px;
+  margin: 0 auto;
+}
+
+/* Typography */
+h1 {
+  font-size: var(--font-xl);
+  font-weight: 700;
+  margin-bottom: var(--spacing-lg);
+}
+
+h2 {
+  font-size: var(--font-lg);
+  font-weight: 600;
+  margin-bottom: var(--spacing-md);
+}
+
+a {
+  color: var(--text-link);
+  text-decoration: none;
+}
+
+a:active {
+  opacity: 0.7;
+}
+
+/* Cards */
+.card {
+  background: var(--bg-secondary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: var(--spacing-md);
+  margin-bottom: var(--spacing-sm);
+  transition: background 0.15s ease;
+}
+
+.card:active {
+  background: var(--bg-tertiary);
+}
+
+.card-title {
+  font-weight: 600;
+  font-size: var(--font-base);
+  margin-bottom: var(--spacing-xs);
+  line-height: 1.3;
+}
+
+.card-meta {
+  font-size: var(--font-sm);
+  color: var(--text-secondary);
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: var(--spacing-xs);
+}
+
+.card-body {
+  font-size: var(--font-base);
+  color: var(--text-secondary);
+  margin-top: var(--spacing-sm);
+  line-height: 1.5;
+}
+
+/* Labels / badges */
+.label {
+  display: inline-block;
+  font-size: 0.7rem;
+  padding: 1px 6px;
+  border-radius: var(--radius-pill);
+  font-weight: 500;
+  line-height: 1.5;
+  white-space: nowrap;
+}
+
+.type-badge {
+  font-size: 0.65rem;
+  text-transform: uppercase;
+  font-weight: 700;
+  padding: 1px 5px;
+  border-radius: 4px;
+  white-space: nowrap;
+}
+
+.type-issue {
+  background: rgba(31, 111, 235, 0.13);
+  color: var(--accent-blue);
+  border: 1px solid rgba(31, 111, 235, 0.27);
+}
+
+.type-pull {
+  background: rgba(35, 134, 54, 0.13);
+  color: var(--accent-green);
+  border: 1px solid rgba(35, 134, 54, 0.27);
+}
+
+.state-open {
+  color: var(--accent-green);
+}
+
+.state-closed {
+  color: var(--accent-red);
+}
+
+.state-merged {
+  color: var(--accent-purple);
+}
+
+/* Priority labels */
+.priority-p1 { color: var(--accent-red); border-color: var(--accent-red); }
+.priority-p2 { color: var(--accent-yellow); border-color: var(--accent-yellow); }
+.priority-p3 { color: var(--accent-blue); border-color: var(--accent-blue); }
+
+/* Diff stats */
+.diff-add { color: var(--accent-green); font-size: var(--font-sm); }
+.diff-del { color: var(--accent-red); font-size: var(--font-sm); }
+
+/* Bottom navigation */
+.bottom-nav {
+  position: fixed;
+  bottom: 0;
+  left: 0;
+  right: 0;
+  background: var(--bg-secondary);
+  border-top: 1px solid var(--border);
+  display: flex;
+  justify-content: space-around;
+  align-items: center;
+  height: var(--nav-height);
+  padding-bottom: env(safe-area-inset-bottom);
+  z-index: 100;
+}
+
+.bottom-nav a {
+  color: var(--text-secondary);
+  text-decoration: none;
+  font-size: 0.7rem;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  padding: 4px 0;
+  min-width: 64px;
+  -webkit-tap-highlight-color: transparent;
+}
+
+.bottom-nav a.active {
+  color: var(--accent-blue);
+}
+
+.bottom-nav svg {
+  width: 22px;
+  height: 22px;
+  margin-bottom: 2px;
+}
+
+/* Filter bar */
+.filter-bar {
+  display: flex;
+  gap: var(--spacing-sm);
+  margin-bottom: var(--spacing-lg);
+  overflow-x: auto;
+  -webkit-overflow-scrolling: touch;
+  scrollbar-width: none;
+  padding-bottom: var(--spacing-xs);
+}
+
+.filter-bar::-webkit-scrollbar {
+  display: none;
+}
+
+.filter-bar select,
+.filter-bar input {
+  background: var(--bg-secondary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  color: var(--text-primary);
+  padding: var(--spacing-sm) var(--spacing-md);
+  font-size: var(--font-base);
+  min-width: 0;
+  flex-shrink: 0;
+  appearance: none;
+  -webkit-appearance: none;
+}
+
+.filter-bar select:focus,
+.filter-bar input:focus {
+  outline: none;
+  border-color: var(--accent-blue);
+}
+
+/* Forms */
+.form-group {
+  margin-bottom: var(--spacing-lg);
+}
+
+.form-group label {
+  display: block;
+  font-size: var(--font-sm);
+  color: var(--text-secondary);
+  margin-bottom: var(--spacing-sm);
+}
+
+.form-group input,
+.form-group textarea,
+.form-group select {
+  width: 100%;
+  padding: var(--spacing-sm) var(--spacing-md);
+  font-size: var(--font-lg);
+  background: var(--bg-primary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  color: var(--text-primary);
+  font-family: inherit;
+}
+
+.form-group textarea {
+  min-height: 120px;
+  resize: vertical;
+}
+
+.form-group input:focus,
+.form-group textarea:focus,
+.form-group select:focus {
+  outline: none;
+  border-color: var(--accent-blue);
+}
+
+/* Buttons */
+.btn {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  padding: var(--spacing-md) var(--spacing-lg);
+  font-size: var(--font-lg);
+  font-weight: 600;
+  border: none;
+  border-radius: var(--radius-sm);
+  cursor: pointer;
+  -webkit-tap-highlight-color: transparent;
+  transition: background 0.15s ease;
+}
+
+.btn-primary {
+  background: #238636;
+  color: #fff;
+  width: 100%;
+}
+
+.btn-primary:active {
+  background: #2ea043;
+}
+
+.btn-secondary {
+  background: var(--bg-tertiary);
+  color: var(--text-primary);
+  border: 1px solid var(--border);
+  width: 100%;
+}
+
+.btn-secondary:active {
+  background: var(--border);
+}
+
+.btn-danger {
+  background: #da363322;
+  color: var(--accent-red);
+  border: 1px solid #da363366;
+  width: 100%;
+}
+
+/* Review form */
+.review-options {
+  display: flex;
+  flex-direction: column;
+  gap: var(--spacing-sm);
+  margin-bottom: var(--spacing-lg);
+}
+
+.review-option {
+  display: flex;
+  align-items: center;
+  gap: var(--spacing-sm);
+  padding: var(--spacing-sm);
+  background: var(--bg-secondary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  cursor: pointer;
+}
+
+.review-option input[type="radio"] {
+  accent-color: var(--accent-blue);
+}
+
+/* Comments thread */
+.comment {
+  background: var(--bg-secondary);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  margin-bottom: var(--spacing-sm);
+  overflow: hidden;
+}
+
+.comment-header {
+  padding: var(--spacing-sm) var(--spacing-md);
+  background: var(--bg-tertiary);
+  font-size: var(--font-sm);
+  color: var(--text-secondary);
+  display: flex;
+  align-items: center;
+  gap: var(--spacing-sm);
+}
+
+.comment-body {
+  padding: var(--spacing-md);
+  font-size: var(--font-base);
+  line-height: 1.6;
+}
+
+/* Avatar */
+.avatar {
+  width: 20px;
+  height: 20px;
+  border-radius: 50%;
+  vertical-align: middle;
+}
+
+/* Empty state */
+.empty {
+  text-align: center;
+  color: var(--text-secondary);
+  padding: 3rem var(--spacing-lg);
+  font-size: var(--font-base);
+}
+
+/* Messages */
+.message {
+  padding: var(--spacing-md);
+  border-radius: var(--radius-sm);
+  margin-bottom: var(--spacing-lg);
+  font-size: var(--font-base);
+}
+
+.message.success {
+  background: #0d2818;
+  border: 1px solid #238636;
+  color: var(--accent-green);
+}
+
+.message.error {
+  background: #2d1117;
+  border: 1px solid #da3633;
+  color: var(--accent-red);
+}
+
+.message.info {
+  background: #0c1d2e;
+  border: 1px solid #1f6feb;
+  color: var(--accent-blue);
+}
+
+/* Loading indicator */
+.htmx-indicator {
+  display: none;
+}
+
+.htmx-request .htmx-indicator {
+  display: inline-block;
+}
+
+.spinner {
+  width: 16px;
+  height: 16px;
+  border: 2px solid var(--border);
+  border-top-color: var(--accent-blue);
+  border-radius: 50%;
+  animation: spin 0.6s linear infinite;
+}
+
+@keyframes spin {
+  to { transform: rotate(360deg); }
+}
+
+/* Infinite scroll sentinel */
+.scroll-sentinel {
+  height: 1px;
+  margin-bottom: var(--spacing-lg);
+}
+
+/* Tablet breakpoint: 2-column grid */
+@media (min-width: 640px) {
+  .content {
+    max-width: 960px;
+  }
+
+  .card-grid {
+    display: grid;
+    grid-template-columns: repeat(2, 1fr);
+    gap: var(--spacing-sm);
+  }
+
+  .card-grid .card {
+    margin-bottom: 0;
+  }
+}
+
+/* Respect reduced motion preference */
+@media (prefers-reduced-motion: reduce) {
+  * {
+    animation-duration: 0.01ms !important;
+    transition-duration: 0.01ms !important;
+  }
+}
+
+/* Dark mode is default; light mode override if needed */
+@media (prefers-color-scheme: light) {
+  :root {
+    --bg-primary: #ffffff;
+    --bg-secondary: #f6f8fa;
+    --bg-tertiary: #eaeef2;
+    --border: #d0d7de;
+    --text-primary: #1f2328;
+    --text-secondary: #656d76;
+    --text-link: #0969da;
+  }
+}

static/sw.js

@@ -0,0 +1,86 @@
+// Service Worker for Gitea Mobile PWA
+// Caches the app shell for offline/fast loading.
+
+const CACHE_NAME = 'gitea-mobile-v2';
+const APP_SHELL = [
+  '/',
+  '/static/style.css',
+  '/static/manifest.json',
+  '/static/icon-192.png',
+  '/static/icon-512.png',
+  '/static/htmx.min.js'
+];
+
+// Install: cache app shell resources.
+self.addEventListener('install', (event) => {
+  event.waitUntil(
+    caches.open(CACHE_NAME).then((cache) => {
+      return cache.addAll(APP_SHELL);
+    })
+  );
+  // Activate immediately.
+  self.skipWaiting();
+});
+
+// Activate: clean up old caches.
+self.addEventListener('activate', (event) => {
+  event.waitUntil(
+    caches.keys().then((cacheNames) => {
+      return Promise.all(
+        cacheNames
+          .filter((name) => name !== CACHE_NAME)
+          .map((name) => caches.delete(name))
+      );
+    })
+  );
+  // Take control of all clients immediately.
+  self.clients.claim();
+});
+
+// Fetch: network-first for API/HTML, cache-first for static assets.
+self.addEventListener('fetch', (event) => {
+  const url = new URL(event.request.url);
+
+  // Cache-first for static assets.
+  if (url.pathname.startsWith('/static/')) {
+    event.respondWith(
+      caches.match(event.request).then((cached) => {
+        return cached || fetch(event.request).then((response) => {
+          // Cache the fetched response for next time.
+          const responseClone = response.clone();
+          caches.open(CACHE_NAME).then((cache) => {
+            cache.put(event.request, responseClone);
+          });
+          return response;
+        });
+      })
+    );
+    return;
+  }
+
+  // Network-first for HTML/API requests.
+  if (event.request.headers.get('accept')?.includes('text/html') ||
+      event.request.headers.get('HX-Request')) {
+    event.respondWith(
+      fetch(event.request)
+        .then((response) => {
+          // Cache successful GET responses.
+          if (event.request.method === 'GET' && response.ok) {
+            const responseClone = response.clone();
+            caches.open(CACHE_NAME).then((cache) => {
+              cache.put(event.request, responseClone);
+            });
+          }
+          return response;
+        })
+        .catch(() => {
+          // Fallback to cache if network fails.
+          return caches.match(event.request);
+        })
+    );
+    return;
+  }
+
+  // Default: network only.
+  event.respondWith(fetch(event.request));
+});