feat: read the real gitea backlog into the app (P1 thin slice)

The app now displays its own live backlog instead of fixtures. First
end of the sync loop — the tap-root (#1) grows list reads and a read
path through the Electron main process.

- @commitea/core: client gains `listIssues` (paginated, PRs excluded)
  and `listMilestones`; a `lifecycle-v0` mapper (closed→done,
  labelled/milestoned→triage, bare→diagnosis — steeping/review await
  event inference in P1-5). +10 unit tests.
- main: gitea bridge over IPC (token stays in main, never the renderer);
  config from env / .env.local; gated off under COMMITEA_E2E so the
  committed e2e stays on fixtures. Preload exposes the typed bridge.
- renderer: useBacklog() reconciles once on mount; issuesToBoardColumns
  shapes real issues into The pot. Board takes optional real columns +
  a loading state, falling back to demo fixtures when unconfigured.

Verified: 14 e2e green (fixture mode) + a gated live spec that launches
against the real repo — the board renders the actual 25 open + 9 closed
issues (screenshot). SQLite mirror + reconcile-on-a-timer + lifecycle
event inference are the next slices (#2/#3/#5).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/desktop/e2e/live-backlog.spec.ts

@@ -0,0 +1,29 @@
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { _electron as electron, expect, test } from '@playwright/test'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const MAIN = join(here, '..', 'out', 'main', 'index.js')
+
+// Opt-in only (GITEA_LIVE=1). Launches WITHOUT COMMITEA_E2E so the main process
+// reconciles the real repo via .env.local, and asserts real issues render.
+test.describe('live backlog', () => {
+  test('The pot shows real gitea issues', async () => {
+    test.skip(!process.env.GITEA_LIVE, 'GITEA_LIVE not set — opt-in live test')
+    const app = await electron.launch({ args: [MAIN], env: { ...process.env } })
+    const win = await app.firstWindow()
+    await win.waitForLoadState('domcontentloaded')
+
+    await win.getByRole('navigation', { name: 'Primary' }).getByRole('button', { name: 'The pot' }).click()
+    // our filed dogfood issue #1 (now closed → Done column) — real gitea data
+    await expect(win.getByText('Gitea read client behind an injected fetch')).toBeVisible({ timeout: 15000 })
+
+    await win.screenshot({
+      path: join(here, '.artifacts', 'screens', 'live-board.png'),
+      fullPage: true,
+      animations: 'disabled',
+    })
+    await app.close()
+  })
+})