fix(#120): detect VCS host for releases API and derive action-repo

Both composite actions hardcoded:
- Gitea's /api/v1/ releases endpoint path
- 'rodin/review-bot' as the action source repo
- .gitea version used GITEA_URL/GITEA_REPO env vars instead of
  GITHUB_SERVER_URL/GITHUB_REPOSITORY

Fix:
- Add 'action-repo' input (default: empty) to allow explicit override
- Auto-detect VCS host from server_url: URLs containing 'gitea' use
  /api/v1/ (Gitea format), all others use /api/v3/ (GitHub format)
- Set smart default action-repo: 'rodin/review-bot' on Gitea,
  'strat/review-bot' on GitHub
- Pass server-url and action-repo as step outputs to avoid re-computing
- Fix .gitea action's 'Run review' env to use GITHUB_SERVER_URL and
  GITHUB_REPOSITORY (matching .github version and review-bot binary
  env var expectations)
- Add .github/workflows/review.yml for self-testing on github.concur.com

Backward compatible: existing Gitea callers using default inputs continue
to resolve rodin/review-bot via /api/v1/ unchanged.

Closes #120

.github/workflows/review.yml

@@ -0,0 +1,42 @@
+# Self-review workflow for strat/review-bot on GitHub Enterprise Server.
+# Uses the composite action from this repo to validate that the action works
+# correctly on GitHub (not just Gitea). This is the end-to-end integration test:
+# a PR here will trigger the action, which must detect GitHub API format and
+# download the binary correctly.
+name: Review
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  review:
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request'
+    strategy:
+      matrix:
+        include:
+          - name: sonnet
+            token_secret: SONNET_REVIEW_TOKEN
+            model: anthropic--claude-4.6-sonnet
+          - name: gpt
+            token_secret: GPT_REVIEW_TOKEN
+            model: gpt-5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run ${{ matrix.name }} review
+        uses: ./.gitea/actions/review
+        with:
+          reviewer-token: ${{ secrets[matrix.token_secret] }}
+          reviewer-name: ${{ matrix.name }}
+          llm-model: ${{ matrix.model }}
+          llm-provider: aicore
+          aicore-client-id: ${{ secrets.AICORE_CLIENT_ID }}
+          aicore-client-secret: ${{ secrets.AICORE_CLIENT_SECRET }}
+          aicore-auth-url: ${{ secrets.AICORE_AUTH_URL }}
+          aicore-api-url: ${{ secrets.AICORE_API_URL }}
+          aicore-resource-group: ${{ secrets.AICORE_RESOURCE_GROUP }}
+          conventions-file: CONVENTIONS.md
+          patterns-repo: rodin/go-patterns
+          patterns-files: 'README.md,patterns/'
+          timeout: '600'