fix: diff-fetch fallback chain — stop failing open on compare 404

~23% of reviews were failing open with `diff fetch failed: gitea GET
/{owner}/{repo}/compare/{before}...{after}.diff -> 404`. Probing the live
forge (Gitea 1.27.1) showed the web compare route answers 404 for ALL refs
on private repos — it does not honor `Authorization: token` and resolves as
anonymous — while the API compare (JSON) and per-commit
/git/commits/{sha}.diff endpoints succeed for the exact same sha pairs.
It also 404s legitimately when `before` is unknown (force-push, rebase).

fetchDiff now walks a fallback chain instead of failing open on the first
404 (any non-404 error still propagates immediately):

  PR job:     pulls/{n}.diff -> git/commits/{head}.diff
  range push: web compare {before}...{after}.diff
              -> web compare {defaultBranch}...{after}.diff
              -> API compare commit list (falls back to the webhook's
                 commitShas) -> concatenated per-commit git/commits/{sha}.diff,
                 stopping past maxDiffBytes so the existing truncation cap
                 (verdict capped at 'warn') kicks in
              -> git/commits/{after}.diff alone
  new branch: git/commits/{after}.diff (unchanged)

Only when every source is exhausted does the review fail open, and the log
line now lists every URL tried. Webhook jobs carry the repo default_branch
so the fallback needs no extra API call; getRepo() covers recovered jobs
persisted before this change.

Verified against the live forge for the exact failing pair from today's
service.log (Nirlabinc/shreai 481d8663...46696b50): the chain recovers a
full-range 8,993-byte diff via 2/2 per-commit diffs.

Co-Authored-By: Claude Fable 5 <[email protected]>

src/lib/webhook.js

@@ -27,6 +27,7 @@ export function jobFromWebhook(event, payload) {
       sha: after,
       ref: payload.ref,
       before: payload.before,
+      defaultBranch: payload.repository?.default_branch || null,
       prIndex: null,
       prTitle: null,
       pusher: payload.pusher?.username || payload.pusher?.login || null,
@@ -48,6 +49,7 @@ export function jobFromWebhook(event, payload) {
       sha: pr.head?.sha,
       ref: pr.head?.ref,
       before: null,
+      defaultBranch: payload.repository?.default_branch || null,
       prIndex: pr.number,
       prTitle: pr.title || null,
       pusher: payload.sender?.username || payload.sender?.login || null,