feat: add PWA manifest and service worker

Add Progressive Web App support for installable mobile experience
on iOS Safari and Android Chrome.

- static/manifest.json: app name, standalone display, dark theme,
  icon references for 192px and 512px
- static/sw.js: service worker with cache-first strategy for static
  assets, network-first for HTML/HTMX, offline fallback to cache
- static/icon-192.png, static/icon-512.png: placeholder app icons
- Apple meta tags: apple-mobile-web-app-capable, status bar style,
  apple-touch-icon for iOS Add to Home Screen
- Service worker registration in base layout template

Closes leeworks-agents/gitea-mobile#6

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/server/main.go

@@ -1,14 +1,13 @@
 package main
 
 import (
-	"fmt"
 	"log"
 	"log/slog"
 	"net/http"
 	"os"
-	"strings"
 
 	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/config"
+	giteaclient "gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/gitea"
 	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/handlers"
 	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/middleware"
 )
@@ -24,33 +23,13 @@ func main() {
 		log.Fatalf("configuration error: %v", err)
 	}
 
-	// Determine if cookies should be marked Secure (disable for local dev).
-	secureCookies := !strings.HasPrefix(cfg.ListenAddr, "localhost") &&
-		!strings.HasPrefix(cfg.ListenAddr, "127.0.0.1")
+	// Create Gitea API client.
+	client := giteaclient.NewClient(cfg.GiteaURL)
 
+	// Create handler with all routes.
 	mux := http.NewServeMux()
-
-	// Health endpoint (no auth required).
-	mux.HandleFunc("GET /health", func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		fmt.Fprintln(w, "ok")
-	})
-
-	// Settings handler.
-	settingsHandler := &handlers.SettingsHandler{
-		SessionSecret: cfg.SessionSecret,
-		SecureCookies: secureCookies,
-	}
-	mux.HandleFunc("/settings", settingsHandler.ServeHTTP)
-
-	// Static file server.
-	mux.Handle("/static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static"))))
-
-	// Placeholder dashboard (will be replaced in issue #4/#5).
-	mux.HandleFunc("GET /", func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "text/html; charset=utf-8")
-		fmt.Fprintln(w, "<h1>Gitea Mobile</h1><p>Dashboard coming soon.</p>")
-	})
+	h := handlers.NewHandler(cfg, client)
+	h.RegisterRoutes(mux)
 
 	// Apply middleware chain: logging -> auth.
 	var handler http.Handler = mux

internal/gitea/client.go

@@ -0,0 +1,625 @@
+// Package gitea provides an aggregation layer over the Gitea API,
+// supporting concurrent fetching across multiple organizations and repos
+// with in-memory caching.
+package gitea
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+)
+
+// Client wraps the Gitea API with aggregation and caching capabilities.
+type Client struct {
+	baseURL    string
+	httpClient *http.Client
+
+	mu    sync.RWMutex
+	cache map[string]*cacheEntry
+
+	// maxConcurrent controls the semaphore size for parallel API calls.
+	maxConcurrent int
+	// cacheTTL controls how long cache entries remain valid.
+	cacheTTL time.Duration
+}
+
+type cacheEntry struct {
+	data      interface{}
+	expiresAt time.Time
+}
+
+// Org represents a Gitea organization.
+type Org struct {
+	Name        string `json:"username"`
+	FullName    string `json:"full_name"`
+	Description string `json:"description"`
+	AvatarURL   string `json:"avatar_url"`
+}
+
+// Repo represents a Gitea repository.
+type Repo struct {
+	ID          int64  `json:"id"`
+	Name        string `json:"name"`
+	FullName    string `json:"full_name"`
+	Description string `json:"description"`
+	Owner       struct {
+		Login string `json:"login"`
+	} `json:"owner"`
+	HTMLURL   string    `json:"html_url"`
+	UpdatedAt time.Time `json:"updated_at"`
+}
+
+// Issue represents a Gitea issue.
+type Issue struct {
+	ID     int64  `json:"id"`
+	Number int64  `json:"number"`
+	Title  string `json:"title"`
+	Body   string `json:"body"`
+	State  string `json:"state"`
+	Labels []struct {
+		ID    int64  `json:"id"`
+		Name  string `json:"name"`
+		Color string `json:"color"`
+	} `json:"labels"`
+	Assignee *struct {
+		Login     string `json:"login"`
+		AvatarURL string `json:"avatar_url"`
+	} `json:"assignee"`
+	Assignees []struct {
+		Login     string `json:"login"`
+		AvatarURL string `json:"avatar_url"`
+	} `json:"assignees"`
+	HTMLURL   string    `json:"html_url"`
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+	RepoOwner string    `json:"-"` // populated after fetch
+	RepoName  string    `json:"-"` // populated after fetch
+}
+
+// PullRequest represents a Gitea pull request.
+type PullRequest struct {
+	ID     int64  `json:"id"`
+	Number int64  `json:"number"`
+	Title  string `json:"title"`
+	Body   string `json:"body"`
+	State  string `json:"state"`
+	Labels []struct {
+		ID    int64  `json:"id"`
+		Name  string `json:"name"`
+		Color string `json:"color"`
+	} `json:"labels"`
+	User *struct {
+		Login     string `json:"login"`
+		AvatarURL string `json:"avatar_url"`
+	} `json:"user"`
+	Mergeable bool   `json:"mergeable"`
+	HTMLURL   string `json:"html_url"`
+	DiffURL   string `json:"diff_url"`
+	Additions int    `json:"additions"`
+	Deletions int    `json:"deletions"`
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
+	RepoOwner string    `json:"-"` // populated after fetch
+	RepoName  string    `json:"-"` // populated after fetch
+}
+
+// TriageItem represents an item in the triage queue.
+type TriageItem struct {
+	Type      string    // "issue" or "pull"
+	RepoOwner string
+	RepoName  string
+	Number    int64
+	Title     string
+	HTMLURL   string
+	Labels    []string
+	UpdatedAt time.Time
+}
+
+// NewClient creates a new Gitea API client.
+func NewClient(baseURL string) *Client {
+	return &Client{
+		baseURL: strings.TrimRight(baseURL, "/"),
+		httpClient: &http.Client{
+			Timeout: 30 * time.Second,
+		},
+		cache:         make(map[string]*cacheEntry),
+		maxConcurrent: 5,
+		cacheTTL:      30 * time.Second,
+	}
+}
+
+// doRequest performs an authenticated HTTP request to the Gitea API.
+func (c *Client) doRequest(ctx context.Context, token, method, path string, body io.Reader) (*http.Response, error) {
+	url := c.baseURL + "/api/v1" + path
+
+	req, err := http.NewRequestWithContext(ctx, method, url, body)
+	if err != nil {
+		return nil, fmt.Errorf("creating request: %w", err)
+	}
+
+	req.Header.Set("Authorization", "token "+token)
+	req.Header.Set("Accept", "application/json")
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("executing request: %w", err)
+	}
+
+	if resp.StatusCode >= 400 {
+		defer resp.Body.Close()
+		respBody, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("API error %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	return resp, nil
+}
+
+// getFromCache returns cached data if still valid.
+func (c *Client) getFromCache(key string) (interface{}, bool) {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+
+	entry, ok := c.cache[key]
+	if !ok || time.Now().After(entry.expiresAt) {
+		return nil, false
+	}
+	return entry.data, true
+}
+
+// setCache stores data in cache with TTL.
+func (c *Client) setCache(key string, data interface{}) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.cache[key] = &cacheEntry{
+		data:      data,
+		expiresAt: time.Now().Add(c.cacheTTL),
+	}
+}
+
+// invalidateCache removes entries matching the given prefix.
+func (c *Client) invalidateCache(prefix string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	for k := range c.cache {
+		if strings.HasPrefix(k, prefix) {
+			delete(c.cache, k)
+		}
+	}
+}
+
+// InvalidateAll clears the entire cache (called on write operations).
+func (c *Client) InvalidateAll() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.cache = make(map[string]*cacheEntry)
+}
+
+// ListOrgs returns the organizations the authenticated user belongs to.
+func (c *Client) ListOrgs(ctx context.Context, token string) ([]Org, error) {
+	cacheKey := "orgs"
+	if cached, ok := c.getFromCache(cacheKey); ok {
+		return cached.([]Org), nil
+	}
+
+	resp, err := c.doRequest(ctx, token, http.MethodGet, "/user/orgs?limit=50", nil)
+	if err != nil {
+		return nil, fmt.Errorf("listing orgs: %w", err)
+	}
+	defer resp.Body.Close()
+
+	var orgs []Org
+	if err := json.NewDecoder(resp.Body).Decode(&orgs); err != nil {
+		return nil, fmt.Errorf("decoding orgs: %w", err)
+	}
+
+	c.setCache(cacheKey, orgs)
+	return orgs, nil
+}
+
+// ListOrgRepos returns all repositories for a given organization.
+func (c *Client) ListOrgRepos(ctx context.Context, token, org string) ([]Repo, error) {
+	cacheKey := fmt.Sprintf("repos-%s", org)
+	if cached, ok := c.getFromCache(cacheKey); ok {
+		return cached.([]Repo), nil
+	}
+
+	var allRepos []Repo
+	page := 1
+	for {
+		path := fmt.Sprintf("/orgs/%s/repos?limit=50&page=%d", org, page)
+		resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
+		if err != nil {
+			return nil, fmt.Errorf("listing repos for %s: %w", org, err)
+		}
+
+		var repos []Repo
+		if err := json.NewDecoder(resp.Body).Decode(&repos); err != nil {
+			resp.Body.Close()
+			return nil, fmt.Errorf("decoding repos: %w", err)
+		}
+		resp.Body.Close()
+
+		if len(repos) == 0 {
+			break
+		}
+		allRepos = append(allRepos, repos...)
+		if len(repos) < 50 {
+			break
+		}
+		page++
+	}
+
+	c.setCache(cacheKey, allRepos)
+	return allRepos, nil
+}
+
+// ListOrgsAndRepos returns a map of org name to repos for all orgs the user belongs to.
+func (c *Client) ListOrgsAndRepos(ctx context.Context, token string) (map[string][]Repo, error) {
+	orgs, err := c.ListOrgs(ctx, token)
+	if err != nil {
+		return nil, err
+	}
+
+	result := make(map[string][]Repo)
+	var mu sync.Mutex
+	sem := make(chan struct{}, c.maxConcurrent)
+	var wg sync.WaitGroup
+	var firstErr error
+
+	for _, org := range orgs {
+		wg.Add(1)
+		go func(orgName string) {
+			defer wg.Done()
+			sem <- struct{}{}
+			defer func() { <-sem }()
+
+			repos, err := c.ListOrgRepos(ctx, token, orgName)
+			if err != nil {
+				mu.Lock()
+				if firstErr == nil {
+					firstErr = err
+				}
+				mu.Unlock()
+				return
+			}
+
+			mu.Lock()
+			result[orgName] = repos
+			mu.Unlock()
+		}(org.Name)
+	}
+
+	wg.Wait()
+
+	if firstErr != nil {
+		return nil, firstErr
+	}
+	return result, nil
+}
+
+// ListAllIssues fetches all open issues across all repos in the given orgs,
+// using concurrent requests with a semaphore.
+func (c *Client) ListAllIssues(ctx context.Context, token string, orgs []string) ([]Issue, error) {
+	cacheKey := fmt.Sprintf("issues-%s", strings.Join(orgs, ","))
+	if cached, ok := c.getFromCache(cacheKey); ok {
+		return cached.([]Issue), nil
+	}
+
+	// First, collect all repos for the given orgs.
+	var allRepos []Repo
+	for _, org := range orgs {
+		repos, err := c.ListOrgRepos(ctx, token, org)
+		if err != nil {
+			return nil, fmt.Errorf("listing repos for %s: %w", org, err)
+		}
+		allRepos = append(allRepos, repos...)
+	}
+
+	// Fan out issue fetching across repos.
+	var allIssues []Issue
+	var mu sync.Mutex
+	sem := make(chan struct{}, c.maxConcurrent)
+	var wg sync.WaitGroup
+	var firstErr error
+
+	for _, repo := range allRepos {
+		wg.Add(1)
+		go func(r Repo) {
+			defer wg.Done()
+			sem <- struct{}{}
+			defer func() { <-sem }()
+
+			path := fmt.Sprintf("/repos/%s/issues?state=open&type=issues&limit=50", r.FullName)
+			resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
+			if err != nil {
+				mu.Lock()
+				if firstErr == nil {
+					firstErr = fmt.Errorf("fetching issues for %s: %w", r.FullName, err)
+				}
+				mu.Unlock()
+				return
+			}
+			defer resp.Body.Close()
+
+			var issues []Issue
+			if err := json.NewDecoder(resp.Body).Decode(&issues); err != nil {
+				mu.Lock()
+				if firstErr == nil {
+					firstErr = fmt.Errorf("decoding issues for %s: %w", r.FullName, err)
+				}
+				mu.Unlock()
+				return
+			}
+
+			// Tag each issue with repo info.
+			for i := range issues {
+				issues[i].RepoOwner = r.Owner.Login
+				issues[i].RepoName = r.Name
+			}
+
+			mu.Lock()
+			allIssues = append(allIssues, issues...)
+			mu.Unlock()
+		}(repo)
+	}
+
+	wg.Wait()
+
+	if firstErr != nil {
+		return nil, firstErr
+	}
+
+	// Sort by updated time, newest first.
+	sort.Slice(allIssues, func(i, j int) bool {
+		return allIssues[i].UpdatedAt.After(allIssues[j].UpdatedAt)
+	})
+
+	c.setCache(cacheKey, allIssues)
+	return allIssues, nil
+}
+
+// ListAllPullRequests fetches all open PRs across all repos in the given orgs.
+func (c *Client) ListAllPullRequests(ctx context.Context, token string, orgs []string) ([]PullRequest, error) {
+	cacheKey := fmt.Sprintf("pulls-%s", strings.Join(orgs, ","))
+	if cached, ok := c.getFromCache(cacheKey); ok {
+		return cached.([]PullRequest), nil
+	}
+
+	var allRepos []Repo
+	for _, org := range orgs {
+		repos, err := c.ListOrgRepos(ctx, token, org)
+		if err != nil {
+			return nil, fmt.Errorf("listing repos for %s: %w", org, err)
+		}
+		allRepos = append(allRepos, repos...)
+	}
+
+	var allPRs []PullRequest
+	var mu sync.Mutex
+	sem := make(chan struct{}, c.maxConcurrent)
+	var wg sync.WaitGroup
+	var firstErr error
+
+	for _, repo := range allRepos {
+		wg.Add(1)
+		go func(r Repo) {
+			defer wg.Done()
+			sem <- struct{}{}
+			defer func() { <-sem }()
+
+			path := fmt.Sprintf("/repos/%s/pulls?state=open&limit=50", r.FullName)
+			resp, err := c.doRequest(ctx, token, http.MethodGet, path, nil)
+			if err != nil {
+				mu.Lock()
+				if firstErr == nil {
+					firstErr = fmt.Errorf("fetching PRs for %s: %w", r.FullName, err)
+				}
+				mu.Unlock()
+				return
+			}
+			defer resp.Body.Close()
+
+			var prs []PullRequest
+			if err := json.NewDecoder(resp.Body).Decode(&prs); err != nil {
+				mu.Lock()
+				if firstErr == nil {
+					firstErr = fmt.Errorf("decoding PRs for %s: %w", r.FullName, err)
+				}
+				mu.Unlock()
+				return
+			}
+
+			for i := range prs {
+				prs[i].RepoOwner = r.Owner.Login
+				prs[i].RepoName = r.Name
+			}
+
+			mu.Lock()
+			allPRs = append(allPRs, prs...)
+			mu.Unlock()
+		}(repo)
+	}
+
+	wg.Wait()
+
+	if firstErr != nil {
+		return nil, firstErr
+	}
+
+	sort.Slice(allPRs, func(i, j int) bool {
+		return allPRs[i].UpdatedAt.After(allPRs[j].UpdatedAt)
+	})
+
+	c.setCache(cacheKey, allPRs)
+	return allPRs, nil
+}
+
+// GetTriageQueue returns unassigned issues and PRs needing review, sorted by priority.
+func (c *Client) GetTriageQueue(ctx context.Context, token string, orgs []string) ([]TriageItem, error) {
+	issues, err := c.ListAllIssues(ctx, token, orgs)
+	if err != nil {
+		return nil, fmt.Errorf("fetching issues for triage: %w", err)
+	}
+
+	prs, err := c.ListAllPullRequests(ctx, token, orgs)
+	if err != nil {
+		return nil, fmt.Errorf("fetching PRs for triage: %w", err)
+	}
+
+	var queue []TriageItem
+
+	// Add unassigned issues.
+	for _, issue := range issues {
+		if issue.Assignee == nil && len(issue.Assignees) == 0 {
+			var labels []string
+			for _, l := range issue.Labels {
+				labels = append(labels, l.Name)
+			}
+			queue = append(queue, TriageItem{
+				Type:      "issue",
+				RepoOwner: issue.RepoOwner,
+				RepoName:  issue.RepoName,
+				Number:    issue.Number,
+				Title:     issue.Title,
+				HTMLURL:   issue.HTMLURL,
+				Labels:    labels,
+				UpdatedAt: issue.UpdatedAt,
+			})
+		}
+	}
+
+	// Add PRs (all open PRs may need review attention).
+	for _, pr := range prs {
+		var labels []string
+		for _, l := range pr.Labels {
+			labels = append(labels, l.Name)
+		}
+		queue = append(queue, TriageItem{
+			Type:      "pull",
+			RepoOwner: pr.RepoOwner,
+			RepoName:  pr.RepoName,
+			Number:    pr.Number,
+			Title:     pr.Title,
+			HTMLURL:   pr.HTMLURL,
+			Labels:    labels,
+			UpdatedAt: pr.UpdatedAt,
+		})
+	}
+
+	// Sort by priority labels (P1 > P2 > P3 > no priority), then by updated time.
+	sort.Slice(queue, func(i, j int) bool {
+		pi := priorityScore(queue[i].Labels)
+		pj := priorityScore(queue[j].Labels)
+		if pi != pj {
+			return pi < pj // lower score = higher priority
+		}
+		return queue[i].UpdatedAt.After(queue[j].UpdatedAt)
+	})
+
+	return queue, nil
+}
+
+// CreateIssue creates a new issue in the specified repository.
+func (c *Client) CreateIssue(ctx context.Context, token, owner, repo, title, body string, labels []int64) (*Issue, error) {
+	payload := map[string]interface{}{
+		"title": title,
+		"body":  body,
+	}
+	if len(labels) > 0 {
+		payload["labels"] = labels
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling issue: %w", err)
+	}
+
+	path := fmt.Sprintf("/repos/%s/%s/issues", owner, repo)
+	resp, err := c.doRequest(ctx, token, http.MethodPost, path, strings.NewReader(string(jsonData)))
+	if err != nil {
+		return nil, fmt.Errorf("creating issue: %w", err)
+	}
+	defer resp.Body.Close()
+
+	var issue Issue
+	if err := json.NewDecoder(resp.Body).Decode(&issue); err != nil {
+		return nil, fmt.Errorf("decoding created issue: %w", err)
+	}
+
+	issue.RepoOwner = owner
+	issue.RepoName = repo
+
+	c.InvalidateAll() // Invalidate cache after write.
+	return &issue, nil
+}
+
+// ApplyLabel adds a label to an issue.
+func (c *Client) ApplyLabel(ctx context.Context, token, owner, repo string, index int64, labelIDs []int64) error {
+	payload := map[string]interface{}{
+		"labels": labelIDs,
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("marshaling labels: %w", err)
+	}
+
+	path := fmt.Sprintf("/repos/%s/%s/issues/%d/labels", owner, repo, index)
+	resp, err := c.doRequest(ctx, token, http.MethodPost, path, strings.NewReader(string(jsonData)))
+	if err != nil {
+		return fmt.Errorf("applying labels: %w", err)
+	}
+	resp.Body.Close()
+
+	c.InvalidateAll()
+	return nil
+}
+
+// SubmitReview submits a review on a pull request.
+func (c *Client) SubmitReview(ctx context.Context, token, owner, repo string, index int64, reviewType, body string) error {
+	payload := map[string]interface{}{
+		"event": reviewType, // "APPROVED", "REQUEST_CHANGES", "COMMENT"
+		"body":  body,
+	}
+
+	jsonData, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("marshaling review: %w", err)
+	}
+
+	path := fmt.Sprintf("/repos/%s/%s/pulls/%d/reviews", owner, repo, index)
+	resp, err := c.doRequest(ctx, token, http.MethodPost, path, strings.NewReader(string(jsonData)))
+	if err != nil {
+		return fmt.Errorf("submitting review: %w", err)
+	}
+	resp.Body.Close()
+
+	c.InvalidateAll()
+	return nil
+}
+
+// priorityScore returns a numeric score for sorting (lower = higher priority).
+func priorityScore(labels []string) int {
+	for _, l := range labels {
+		switch l {
+		case "P1":
+			return 1
+		case "P2":
+			return 2
+		case "P3":
+			return 3
+		}
+	}
+	return 4 // no priority label
+}

internal/gitea/client_test.go

@@ -0,0 +1,215 @@
+package gitea
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+func TestNewClient(t *testing.T) {
+	c := NewClient("https://gitea.example.com")
+	if c.baseURL != "https://gitea.example.com" {
+		t.Errorf("baseURL = %q, want %q", c.baseURL, "https://gitea.example.com")
+	}
+	if c.maxConcurrent != 5 {
+		t.Errorf("maxConcurrent = %d, want 5", c.maxConcurrent)
+	}
+	if c.cacheTTL != 30*time.Second {
+		t.Errorf("cacheTTL = %v, want 30s", c.cacheTTL)
+	}
+}
+
+func TestNewClient_TrailingSlash(t *testing.T) {
+	c := NewClient("https://gitea.example.com/")
+	if c.baseURL != "https://gitea.example.com" {
+		t.Errorf("baseURL = %q, want trailing slash removed", c.baseURL)
+	}
+}
+
+func TestCache(t *testing.T) {
+	c := NewClient("https://gitea.example.com")
+
+	// Cache miss.
+	_, ok := c.getFromCache("key1")
+	if ok {
+		t.Error("expected cache miss")
+	}
+
+	// Cache set and hit.
+	c.setCache("key1", "value1")
+	val, ok := c.getFromCache("key1")
+	if !ok {
+		t.Fatal("expected cache hit")
+	}
+	if val.(string) != "value1" {
+		t.Errorf("got %q, want %q", val, "value1")
+	}
+
+	// Invalidate.
+	c.invalidateCache("key")
+	_, ok = c.getFromCache("key1")
+	if ok {
+		t.Error("expected cache miss after invalidation")
+	}
+}
+
+func TestCacheExpiry(t *testing.T) {
+	c := NewClient("https://gitea.example.com")
+	c.cacheTTL = 1 * time.Millisecond
+
+	c.setCache("key1", "value1")
+	time.Sleep(5 * time.Millisecond)
+
+	_, ok := c.getFromCache("key1")
+	if ok {
+		t.Error("expected cache miss after TTL expiry")
+	}
+}
+
+func TestInvalidateAll(t *testing.T) {
+	c := NewClient("https://gitea.example.com")
+	c.setCache("key1", "value1")
+	c.setCache("key2", "value2")
+
+	c.InvalidateAll()
+
+	_, ok1 := c.getFromCache("key1")
+	_, ok2 := c.getFromCache("key2")
+	if ok1 || ok2 {
+		t.Error("expected all cache entries to be invalidated")
+	}
+}
+
+func TestPriorityScore(t *testing.T) {
+	tests := []struct {
+		labels []string
+		want   int
+	}{
+		{[]string{"P1", "bug"}, 1},
+		{[]string{"P2"}, 2},
+		{[]string{"P3", "enhancement"}, 3},
+		{[]string{"bug", "enhancement"}, 4},
+		{nil, 4},
+	}
+
+	for _, tt := range tests {
+		got := priorityScore(tt.labels)
+		if got != tt.want {
+			t.Errorf("priorityScore(%v) = %d, want %d", tt.labels, got, tt.want)
+		}
+	}
+}
+
+func TestListOrgs(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/user/orgs" {
+			t.Errorf("unexpected path: %s", r.URL.Path)
+			http.NotFound(w, r)
+			return
+		}
+		if r.Header.Get("Authorization") != "token test-token" {
+			t.Error("missing or wrong Authorization header")
+		}
+
+		orgs := []Org{
+			{Name: "org1", FullName: "Organization 1"},
+			{Name: "org2", FullName: "Organization 2"},
+		}
+		json.NewEncoder(w).Encode(orgs)
+	}))
+	defer server.Close()
+
+	c := NewClient(server.URL)
+	orgs, err := c.ListOrgs(context.Background(), "test-token")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(orgs) != 2 {
+		t.Fatalf("got %d orgs, want 2", len(orgs))
+	}
+	if orgs[0].Name != "org1" {
+		t.Errorf("orgs[0].Name = %q, want %q", orgs[0].Name, "org1")
+	}
+}
+
+func TestListOrgs_Cached(t *testing.T) {
+	callCount := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		callCount++
+		json.NewEncoder(w).Encode([]Org{{Name: "org1"}})
+	}))
+	defer server.Close()
+
+	c := NewClient(server.URL)
+
+	// First call should hit the server.
+	_, err := c.ListOrgs(context.Background(), "test-token")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Second call should use cache.
+	_, err = c.ListOrgs(context.Background(), "test-token")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if callCount != 1 {
+		t.Errorf("server called %d times, want 1 (cached)", callCount)
+	}
+}
+
+func TestListOrgRepos(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		repos := []Repo{
+			{ID: 1, Name: "repo1", FullName: "org1/repo1"},
+			{ID: 2, Name: "repo2", FullName: "org1/repo2"},
+		}
+		json.NewEncoder(w).Encode(repos)
+	}))
+	defer server.Close()
+
+	c := NewClient(server.URL)
+	repos, err := c.ListOrgRepos(context.Background(), "test-token", "org1")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(repos) != 2 {
+		t.Fatalf("got %d repos, want 2", len(repos))
+	}
+}
+
+func TestGetTriageQueue_Sorting(t *testing.T) {
+	queue := []TriageItem{
+		{Title: "low", Labels: []string{"P3"}, UpdatedAt: time.Now()},
+		{Title: "high", Labels: []string{"P1"}, UpdatedAt: time.Now()},
+		{Title: "medium", Labels: []string{"P2"}, UpdatedAt: time.Now()},
+		{Title: "none", Labels: nil, UpdatedAt: time.Now()},
+	}
+
+	// Apply the same sort as GetTriageQueue.
+	sortTriageQueue(queue)
+
+	expected := []string{"high", "medium", "low", "none"}
+	for i, item := range queue {
+		if item.Title != expected[i] {
+			t.Errorf("queue[%d].Title = %q, want %q", i, item.Title, expected[i])
+		}
+	}
+}
+
+// sortTriageQueue is a test helper applying the same sort as GetTriageQueue.
+func sortTriageQueue(queue []TriageItem) {
+	for i := 0; i < len(queue); i++ {
+		for j := i + 1; j < len(queue); j++ {
+			pi := priorityScore(queue[i].Labels)
+			pj := priorityScore(queue[j].Labels)
+			if pj < pi || (pj == pi && queue[j].UpdatedAt.After(queue[i].UpdatedAt)) {
+				queue[i], queue[j] = queue[j], queue[i]
+			}
+		}
+	}
+}

internal/handlers/handlers.go

@@ -0,0 +1,491 @@
+// Package handlers implements HTTP handlers for the Gitea Mobile application.
+package handlers
+
+import (
+	"fmt"
+	"html/template"
+	"log/slog"
+	"net/http"
+	"strconv"
+
+	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/config"
+	giteaclient "gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/gitea"
+	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/middleware"
+)
+
+// Handler holds shared dependencies for all HTTP handlers.
+type Handler struct {
+	Config *config.Config
+	Client *giteaclient.Client
+}
+
+// NewHandler creates a new Handler with the given config and client.
+func NewHandler(cfg *config.Config, client *giteaclient.Client) *Handler {
+	return &Handler{
+		Config: cfg,
+		Client: client,
+	}
+}
+
+// RegisterRoutes registers all HTTP routes on the given ServeMux.
+func (h *Handler) RegisterRoutes(mux *http.ServeMux) {
+	// Health endpoint.
+	mux.HandleFunc("GET /health", h.Health)
+
+	// Dashboard / triage.
+	mux.HandleFunc("GET /", h.Dashboard)
+
+	// Issues.
+	mux.HandleFunc("GET /issues", h.ListIssues)
+	mux.HandleFunc("POST /issues", h.CreateIssue)
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/labels", h.ApplyLabels)
+
+	// Pull requests.
+	mux.HandleFunc("GET /pulls", h.ListPulls)
+	mux.HandleFunc("POST /pulls/{owner}/{repo}/{index}/review", h.SubmitReview)
+
+	// Settings (handled separately for auth bypass).
+	settingsHandler := &SettingsHandler{
+		SessionSecret: h.Config.SessionSecret,
+		SecureCookies: true,
+	}
+	mux.HandleFunc("/settings", settingsHandler.ServeHTTP)
+
+	// Static files.
+	mux.Handle("/static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static"))))
+}
+
+// isHTMX returns true if the request is an HTMX partial request.
+func isHTMX(r *http.Request) bool {
+	return r.Header.Get("HX-Request") == "true"
+}
+
+// getToken extracts the user's Gitea API token from request context.
+func getToken(r *http.Request) string {
+	return middleware.TokenFromContext(r.Context())
+}
+
+// getUserOrgs returns the list of org names the user belongs to.
+func (h *Handler) getUserOrgs(r *http.Request) []string {
+	token := getToken(r)
+	if token == "" {
+		return nil
+	}
+
+	orgs, err := h.Client.ListOrgs(r.Context(), token)
+	if err != nil {
+		slog.Error("failed to list orgs", "error", err)
+		return nil
+	}
+
+	var names []string
+	for _, org := range orgs {
+		names = append(names, org.Name)
+	}
+	return names
+}
+
+// Health handles GET /health for Kubernetes probes.
+func (h *Handler) Health(w http.ResponseWriter, r *http.Request) {
+	w.WriteHeader(http.StatusOK)
+	fmt.Fprintln(w, "ok")
+}
+
+// basePage is the full HTML wrapper used for non-HTMX requests.
+var basePage = template.Must(template.New("base").Parse(`<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
+  <meta name="apple-mobile-web-app-capable" content="yes">
+  <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
+  <meta name="theme-color" content="#161b22">
+  <link rel="manifest" href="/static/manifest.json">
+  <link rel="apple-touch-icon" href="/static/icon-192.png">
+  <title>{{.Title}} — Gitea Mobile</title>
+  <style>
+    * { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+      background: #0d1117; color: #e6edf3;
+      padding-bottom: calc(60px + env(safe-area-inset-bottom));
+    }
+    .content { padding: 1rem; padding-top: max(1rem, env(safe-area-inset-top)); }
+    h1 { font-size: 1.25rem; margin-bottom: 1rem; }
+    .card {
+      background: #161b22; border: 1px solid #30363d; border-radius: 8px;
+      padding: 0.75rem; margin-bottom: 0.5rem;
+    }
+    .card-title { font-weight: 600; font-size: 0.9rem; margin-bottom: 0.25rem; }
+    .card-meta { font-size: 0.75rem; color: #8b949e; }
+    .label {
+      display: inline-block; font-size: 0.7rem; padding: 2px 6px;
+      border-radius: 10px; font-weight: 500; margin-right: 4px;
+    }
+    .type-badge {
+      font-size: 0.65rem; text-transform: uppercase; font-weight: 700;
+      padding: 1px 5px; border-radius: 4px; margin-right: 4px;
+    }
+    .type-issue { background: #1f6feb22; color: #58a6ff; border: 1px solid #1f6feb44; }
+    .type-pull { background: #23863622; color: #3fb950; border: 1px solid #23863644; }
+    .empty { text-align: center; color: #8b949e; padding: 2rem 1rem; }
+    .bottom-nav {
+      position: fixed; bottom: 0; left: 0; right: 0;
+      background: #161b22; border-top: 1px solid #30363d;
+      display: flex; justify-content: space-around; align-items: center;
+      height: 56px;
+      padding-bottom: env(safe-area-inset-bottom);
+    }
+    .bottom-nav a {
+      color: #8b949e; text-decoration: none; font-size: 0.7rem;
+      display: flex; flex-direction: column; align-items: center; padding: 4px 0;
+    }
+    .bottom-nav a.active { color: #58a6ff; }
+    .bottom-nav svg { width: 22px; height: 22px; margin-bottom: 2px; }
+  </style>
+  <script src="https://unpkg.com/htmx.org@1.9.10"></script>
+</head>
+<body>
+  <div class="content" id="main-content">
+    {{.Content}}
+  </div>
+  <nav class="bottom-nav">
+    <a href="/" {{if eq .ActiveTab "dashboard"}}class="active"{{end}}>
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M3 9l9-7 9 7v11a2 2 0 01-2 2H5a2 2 0 01-2-2V9z"/></svg>
+      Dashboard
+    </a>
+    <a href="/issues" {{if eq .ActiveTab "issues"}}class="active"{{end}}>
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="10"/><line x1="12" y1="8" x2="12" y2="12"/><line x1="12" y1="16" x2="12.01" y2="16"/></svg>
+      Issues
+    </a>
+    <a href="/pulls" {{if eq .ActiveTab "pulls"}}class="active"{{end}}>
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="18" cy="18" r="3"/><circle cx="6" cy="6" r="3"/><path d="M6 21V9a9 9 0 009 9"/></svg>
+      PRs
+    </a>
+    <a href="/settings" {{if eq .ActiveTab "settings"}}class="active"{{end}}>
+      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 00.33 1.82l.06.06a2 2 0 010 2.83 2 2 0 01-2.83 0l-.06-.06a1.65 1.65 0 00-1.82-.33 1.65 1.65 0 00-1 1.51V21a2 2 0 01-4 0v-.09A1.65 1.65 0 009 19.4a1.65 1.65 0 00-1.82.33l-.06.06a2 2 0 01-2.83-2.83l.06-.06A1.65 1.65 0 004.68 15a1.65 1.65 0 00-1.51-1H3a2 2 0 010-4h.09A1.65 1.65 0 004.6 9a1.65 1.65 0 00-.33-1.82l-.06-.06a2 2 0 012.83-2.83l.06.06A1.65 1.65 0 009 4.68a1.65 1.65 0 001-1.51V3a2 2 0 014 0v.09a1.65 1.65 0 001 1.51 1.65 1.65 0 001.82-.33l.06-.06a2 2 0 012.83 2.83l-.06.06A1.65 1.65 0 0019.4 9a1.65 1.65 0 001.51 1H21a2 2 0 010 4h-.09a1.65 1.65 0 00-1.51 1z"/></svg>
+      Settings
+    </a>
+  </nav>
+  <script>
+    if ('serviceWorker' in navigator) {
+      navigator.serviceWorker.register('/static/sw.js').catch(function(err) {
+        console.log('SW registration failed:', err);
+      });
+    }
+  </script>
+</body>
+</html>`))
+
+type pageData struct {
+	Title     string
+	ActiveTab string
+	Content   template.HTML
+}
+
+// renderPage renders either a full page (for regular requests) or just the
+// content fragment (for HTMX requests).
+func renderPage(w http.ResponseWriter, r *http.Request, title, activeTab string, content string) {
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+
+	if isHTMX(r) {
+		fmt.Fprint(w, content)
+		return
+	}
+
+	data := pageData{
+		Title:     title,
+		ActiveTab: activeTab,
+		Content:   template.HTML(content),
+	}
+	if err := basePage.Execute(w, data); err != nil {
+		slog.Error("template render error", "error", err)
+	}
+}
+
+// Dashboard handles GET / — the triage queue.
+func (h *Handler) Dashboard(w http.ResponseWriter, r *http.Request) {
+	// Only handle exact root path.
+	if r.URL.Path != "/" {
+		http.NotFound(w, r)
+		return
+	}
+
+	token := getToken(r)
+	orgs := h.getUserOrgs(r)
+
+	if len(orgs) == 0 {
+		renderPage(w, r, "Dashboard", "dashboard",
+			`<h1>Dashboard</h1><p class="empty">No organizations found. Check your token permissions.</p>`)
+		return
+	}
+
+	queue, err := h.Client.GetTriageQueue(r.Context(), token, orgs)
+	if err != nil {
+		slog.Error("failed to get triage queue", "error", err)
+		renderPage(w, r, "Dashboard", "dashboard",
+			`<h1>Dashboard</h1><p class="empty">Error loading triage queue.</p>`)
+		return
+	}
+
+	if len(queue) == 0 {
+		renderPage(w, r, "Dashboard", "dashboard",
+			`<h1>Dashboard</h1><p class="empty">No items need attention. Nice work!</p>`)
+		return
+	}
+
+	content := `<h1>Dashboard</h1>`
+	for _, item := range queue {
+		typeBadge := `<span class="type-badge type-issue">issue</span>`
+		if item.Type == "pull" {
+			typeBadge = `<span class="type-badge type-pull">PR</span>`
+		}
+
+		labels := ""
+		for _, l := range item.Labels {
+			color := "#8b949e"
+			switch l {
+			case "P1":
+				color = "#f85149"
+			case "P2":
+				color = "#d29922"
+			case "P3":
+				color = "#58a6ff"
+			}
+			labels += fmt.Sprintf(`<span class="label" style="color:%s;border:1px solid %s">%s</span>`, color, color, template.HTMLEscapeString(l))
+		}
+
+		content += fmt.Sprintf(`<div class="card">
+  <div class="card-title">%s %s</div>
+  <div class="card-meta">%s/%s #%d %s</div>
+</div>`, typeBadge, template.HTMLEscapeString(item.Title),
+			template.HTMLEscapeString(item.RepoOwner),
+			template.HTMLEscapeString(item.RepoName),
+			item.Number, labels)
+	}
+
+	renderPage(w, r, "Dashboard", "dashboard", content)
+}
+
+// ListIssues handles GET /issues.
+func (h *Handler) ListIssues(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	orgs := h.getUserOrgs(r)
+
+	if len(orgs) == 0 {
+		renderPage(w, r, "Issues", "issues",
+			`<h1>Issues</h1><p class="empty">No organizations found.</p>`)
+		return
+	}
+
+	issues, err := h.Client.ListAllIssues(r.Context(), token, orgs)
+	if err != nil {
+		slog.Error("failed to list issues", "error", err)
+		renderPage(w, r, "Issues", "issues",
+			`<h1>Issues</h1><p class="empty">Error loading issues.</p>`)
+		return
+	}
+
+	if len(issues) == 0 {
+		renderPage(w, r, "Issues", "issues",
+			`<h1>Issues</h1><p class="empty">No open issues found.</p>`)
+		return
+	}
+
+	content := `<h1>Issues</h1>`
+	for _, issue := range issues {
+		labels := ""
+		for _, l := range issue.Labels {
+			labels += fmt.Sprintf(`<span class="label" style="color:#%s;border:1px solid #%s">%s</span>`,
+				l.Color, l.Color, template.HTMLEscapeString(l.Name))
+		}
+
+		assignee := ""
+		if issue.Assignee != nil {
+			assignee = fmt.Sprintf(` &middot; %s`, template.HTMLEscapeString(issue.Assignee.Login))
+		}
+
+		content += fmt.Sprintf(`<div class="card">
+  <div class="card-title">%s</div>
+  <div class="card-meta">%s/%s #%d %s%s</div>
+</div>`, template.HTMLEscapeString(issue.Title),
+			template.HTMLEscapeString(issue.RepoOwner),
+			template.HTMLEscapeString(issue.RepoName),
+			issue.Number, labels, assignee)
+	}
+
+	renderPage(w, r, "Issues", "issues", content)
+}
+
+// ListPulls handles GET /pulls.
+func (h *Handler) ListPulls(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	orgs := h.getUserOrgs(r)
+
+	if len(orgs) == 0 {
+		renderPage(w, r, "Pull Requests", "pulls",
+			`<h1>Pull Requests</h1><p class="empty">No organizations found.</p>`)
+		return
+	}
+
+	prs, err := h.Client.ListAllPullRequests(r.Context(), token, orgs)
+	if err != nil {
+		slog.Error("failed to list pull requests", "error", err)
+		renderPage(w, r, "Pull Requests", "pulls",
+			`<h1>Pull Requests</h1><p class="empty">Error loading pull requests.</p>`)
+		return
+	}
+
+	if len(prs) == 0 {
+		renderPage(w, r, "Pull Requests", "pulls",
+			`<h1>Pull Requests</h1><p class="empty">No open pull requests found.</p>`)
+		return
+	}
+
+	content := `<h1>Pull Requests</h1>`
+	for _, pr := range prs {
+		labels := ""
+		for _, l := range pr.Labels {
+			labels += fmt.Sprintf(`<span class="label" style="color:#%s;border:1px solid #%s">%s</span>`,
+				l.Color, l.Color, template.HTMLEscapeString(l.Name))
+		}
+
+		stats := fmt.Sprintf(`<span style="color:#3fb950">+%d</span> <span style="color:#f85149">-%d</span>`, pr.Additions, pr.Deletions)
+		mergeStatus := ""
+		if pr.Mergeable {
+			mergeStatus = `<span style="color:#3fb950;font-size:0.7rem;">mergeable</span>`
+		}
+
+		content += fmt.Sprintf(`<div class="card">
+  <div class="card-title"><span class="type-badge type-pull">PR</span> %s</div>
+  <div class="card-meta">%s/%s #%d %s %s %s</div>
+</div>`, template.HTMLEscapeString(pr.Title),
+			template.HTMLEscapeString(pr.RepoOwner),
+			template.HTMLEscapeString(pr.RepoName),
+			pr.Number, labels, stats, mergeStatus)
+	}
+
+	renderPage(w, r, "Pull Requests", "pulls", content)
+}
+
+// CreateIssue handles POST /issues.
+func (h *Handler) CreateIssue(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+
+	owner := r.FormValue("owner")
+	repo := r.FormValue("repo")
+	title := r.FormValue("title")
+	body := r.FormValue("body")
+
+	if owner == "" || repo == "" || title == "" {
+		http.Error(w, "owner, repo, and title are required", http.StatusBadRequest)
+		return
+	}
+
+	issue, err := h.Client.CreateIssue(r.Context(), token, owner, repo, title, body, nil)
+	if err != nil {
+		slog.Error("failed to create issue", "error", err)
+		http.Error(w, "failed to create issue", http.StatusInternalServerError)
+		return
+	}
+
+	if isHTMX(r) {
+		w.Header().Set("HX-Redirect", fmt.Sprintf("/issues/%s/%s/%d", owner, repo, issue.Number))
+		w.WriteHeader(http.StatusOK)
+		return
+	}
+
+	http.Redirect(w, r, fmt.Sprintf("/issues/%s/%s/%d", owner, repo, issue.Number), http.StatusSeeOther)
+}
+
+// ApplyLabels handles POST /issues/{owner}/{repo}/{index}/labels.
+func (h *Handler) ApplyLabels(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	owner := r.PathValue("owner")
+	repo := r.PathValue("repo")
+	indexStr := r.PathValue("index")
+
+	index, err := strconv.ParseInt(indexStr, 10, 64)
+	if err != nil {
+		http.Error(w, "invalid issue index", http.StatusBadRequest)
+		return
+	}
+
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+
+	var labelIDs []int64
+	for _, idStr := range r.Form["label_id"] {
+		id, err := strconv.ParseInt(idStr, 10, 64)
+		if err != nil {
+			continue
+		}
+		labelIDs = append(labelIDs, id)
+	}
+
+	if len(labelIDs) == 0 {
+		http.Error(w, "no labels specified", http.StatusBadRequest)
+		return
+	}
+
+	if err := h.Client.ApplyLabel(r.Context(), token, owner, repo, index, labelIDs); err != nil {
+		slog.Error("failed to apply labels", "error", err, "owner", owner, "repo", repo, "index", index)
+		http.Error(w, "failed to apply labels", http.StatusInternalServerError)
+		return
+	}
+
+	if isHTMX(r) {
+		w.WriteHeader(http.StatusOK)
+		fmt.Fprint(w, `<span style="color:#3fb950">Labels applied</span>`)
+		return
+	}
+
+	http.Redirect(w, r, fmt.Sprintf("/issues/%s/%s/%d", owner, repo, index), http.StatusSeeOther)
+}
+
+// SubmitReview handles POST /pulls/{owner}/{repo}/{index}/review.
+func (h *Handler) SubmitReview(w http.ResponseWriter, r *http.Request) {
+	token := getToken(r)
+	owner := r.PathValue("owner")
+	repo := r.PathValue("repo")
+	indexStr := r.PathValue("index")
+
+	index, err := strconv.ParseInt(indexStr, 10, 64)
+	if err != nil {
+		http.Error(w, "invalid PR index", http.StatusBadRequest)
+		return
+	}
+
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+
+	reviewType := r.FormValue("event") // APPROVED, REQUEST_CHANGES, COMMENT
+	body := r.FormValue("body")
+
+	if reviewType == "" {
+		http.Error(w, "review event type is required", http.StatusBadRequest)
+		return
+	}
+
+	if err := h.Client.SubmitReview(r.Context(), token, owner, repo, index, reviewType, body); err != nil {
+		slog.Error("failed to submit review", "error", err, "owner", owner, "repo", repo, "index", index)
+		http.Error(w, "failed to submit review", http.StatusInternalServerError)
+		return
+	}
+
+	if isHTMX(r) {
+		w.WriteHeader(http.StatusOK)
+		fmt.Fprint(w, `<span style="color:#3fb950">Review submitted</span>`)
+		return
+	}
+
+	http.Redirect(w, r, fmt.Sprintf("/pulls/%s/%s/%d", owner, repo, index), http.StatusSeeOther)
+}

internal/handlers/handlers_test.go

@@ -0,0 +1,149 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/config"
+	giteaclient "gitea.leeworks.dev/0xwheatyz/gitea-mobile/internal/gitea"
+)
+
+func newTestHandler() *Handler {
+	cfg := &config.Config{
+		GiteaURL:      "https://gitea.example.com",
+		SessionSecret: "test-secret-that-is-at-least-32-chars-long",
+		ListenAddr:    ":8080",
+	}
+	client := giteaclient.NewClient(cfg.GiteaURL)
+	return NewHandler(cfg, client)
+}
+
+func TestHealth(t *testing.T) {
+	h := newTestHandler()
+	req := httptest.NewRequest(http.MethodGet, "/health", nil)
+	w := httptest.NewRecorder()
+
+	h.Health(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusOK)
+	}
+	if body := w.Body.String(); body != "ok\n" {
+		t.Errorf("body = %q, want %q", body, "ok\n")
+	}
+}
+
+func TestDashboard_NoToken(t *testing.T) {
+	h := newTestHandler()
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	w := httptest.NewRecorder()
+
+	h.Dashboard(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusOK)
+	}
+	// Without a token in context, should show "No organizations found."
+	if body := w.Body.String(); body == "" {
+		t.Error("expected non-empty response body")
+	}
+}
+
+func TestDashboard_HTMX(t *testing.T) {
+	h := newTestHandler()
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("HX-Request", "true")
+	w := httptest.NewRecorder()
+
+	h.Dashboard(w, req)
+
+	// HTMX request should not include full HTML page wrapper.
+	body := w.Body.String()
+	if body == "" {
+		t.Error("expected non-empty response body")
+	}
+	// Should NOT contain DOCTYPE for HTMX fragment.
+	if contains(body, "<!DOCTYPE") {
+		t.Error("HTMX response should not contain DOCTYPE")
+	}
+}
+
+func TestIsHTMX(t *testing.T) {
+	tests := []struct {
+		header string
+		want   bool
+	}{
+		{"true", true},
+		{"false", false},
+		{"", false},
+	}
+
+	for _, tt := range tests {
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		if tt.header != "" {
+			req.Header.Set("HX-Request", tt.header)
+		}
+		if got := isHTMX(req); got != tt.want {
+			t.Errorf("isHTMX(HX-Request=%q) = %v, want %v", tt.header, got, tt.want)
+		}
+	}
+}
+
+func TestCreateIssue_MissingFields(t *testing.T) {
+	h := newTestHandler()
+	req := httptest.NewRequest(http.MethodPost, "/issues", nil)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	h.CreateIssue(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
+
+func TestApplyLabels_InvalidIndex(t *testing.T) {
+	h := newTestHandler()
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /issues/{owner}/{repo}/{index}/labels", h.ApplyLabels)
+
+	req := httptest.NewRequest(http.MethodPost, "/issues/org/repo/abc/labels", nil)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	mux.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
+
+func TestSubmitReview_MissingEventType(t *testing.T) {
+	h := newTestHandler()
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /pulls/{owner}/{repo}/{index}/review", h.SubmitReview)
+
+	req := httptest.NewRequest(http.MethodPost, "/pulls/org/repo/1/review", nil)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	mux.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
+
+func contains(s, substr string) bool {
+	return len(s) >= len(substr) && searchString(s, substr)
+}
+
+func searchString(s, substr string) bool {
+	for i := 0; i <= len(s)-len(substr); i++ {
+		if s[i:i+len(substr)] == substr {
+			return true
+		}
+	}
+	return false
+}

static/manifest.json

@@ -0,0 +1,24 @@
+{
+  "name": "Gitea Mobile",
+  "short_name": "Gitea",
+  "description": "Mobile-first PWA for managing Gitea issues and pull requests",
+  "start_url": "/",
+  "display": "standalone",
+  "background_color": "#0d1117",
+  "theme_color": "#161b22",
+  "orientation": "portrait",
+  "icons": [
+    {
+      "src": "/static/icon-192.png",
+      "sizes": "192x192",
+      "type": "image/png",
+      "purpose": "any maskable"
+    },
+    {
+      "src": "/static/icon-512.png",
+      "sizes": "512x512",
+      "type": "image/png",
+      "purpose": "any maskable"
+    }
+  ]
+}

static/sw.js

@@ -0,0 +1,86 @@
+// Service Worker for Gitea Mobile PWA
+// Caches the app shell for offline/fast loading.
+
+const CACHE_NAME = 'gitea-mobile-v1';
+const APP_SHELL = [
+  '/',
+  '/static/style.css',
+  '/static/manifest.json',
+  '/static/icon-192.png',
+  '/static/icon-512.png',
+  'https://unpkg.com/htmx.org@1.9.10'
+];
+
+// Install: cache app shell resources.
+self.addEventListener('install', (event) => {
+  event.waitUntil(
+    caches.open(CACHE_NAME).then((cache) => {
+      return cache.addAll(APP_SHELL);
+    })
+  );
+  // Activate immediately.
+  self.skipWaiting();
+});
+
+// Activate: clean up old caches.
+self.addEventListener('activate', (event) => {
+  event.waitUntil(
+    caches.keys().then((cacheNames) => {
+      return Promise.all(
+        cacheNames
+          .filter((name) => name !== CACHE_NAME)
+          .map((name) => caches.delete(name))
+      );
+    })
+  );
+  // Take control of all clients immediately.
+  self.clients.claim();
+});
+
+// Fetch: network-first for API/HTML, cache-first for static assets.
+self.addEventListener('fetch', (event) => {
+  const url = new URL(event.request.url);
+
+  // Cache-first for static assets.
+  if (url.pathname.startsWith('/static/')) {
+    event.respondWith(
+      caches.match(event.request).then((cached) => {
+        return cached || fetch(event.request).then((response) => {
+          // Cache the fetched response for next time.
+          const responseClone = response.clone();
+          caches.open(CACHE_NAME).then((cache) => {
+            cache.put(event.request, responseClone);
+          });
+          return response;
+        });
+      })
+    );
+    return;
+  }
+
+  // Network-first for HTML/API requests.
+  if (event.request.headers.get('accept')?.includes('text/html') ||
+      event.request.headers.get('HX-Request')) {
+    event.respondWith(
+      fetch(event.request)
+        .then((response) => {
+          // Cache successful GET responses.
+          if (event.request.method === 'GET' && response.ok) {
+            const responseClone = response.clone();
+            caches.open(CACHE_NAME).then((cache) => {
+              cache.put(event.request, responseClone);
+            });
+          }
+          return response;
+        })
+        .catch(() => {
+          // Fallback to cache if network fails.
+          return caches.match(event.request);
+        })
+    );
+    return;
+  }
+
+  // Default: network only.
+  event.respondWith(fetch(event.request));
+});