sx-gitea Phase 2: access — acl-backed permissions, collaborators, teams, auth-gated routes (TDD, 194/194)

lib/gitea/access.sx: repo role groups (admin>write>read) as acl facts
saturated by the datalog engine; user-owner => admin; collaborators
(per-repo role, upsert); org teams (one role, 'all' or scoped repo
list); org-admin?; visible-repos; create-allowed?; bearer tokens in kv.
Facts derived from forge state, acl db cached in the forge handle and
rebuilt only when facts change.

lib/gitea/web.sx: every repo route now requires read (404 hides private
repos); repo create needs owner/org-admin, delete + collaborator API
need admin (401 no credentials / 403 not allowed); index + /api/repos
list only visible repos; PUT/DELETE collab endpoints.

tests/access.sx (103) + repo suite updated for gating (91). Fixed a
web.sx corruption from the known sx_find_all/sx_replace_node path
mismatch by rewriting via sx_write_file; suite timeout 300->600s.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/gitea/conformance.sh

@@ -22,6 +22,7 @@ VERBOSE="${1:-}"
 # suite name | pass counter | fail counter | failures list
 SUITES=(
   "repo|gitea-repo-pass|gitea-repo-fail|gitea-repo-fails"
+  "access|gitea-access-pass|gitea-access-fail|gitea-access-fails"
 )
 
 OUT_JSON="lib/gitea/scoreboard.json"
@@ -44,14 +45,29 @@ MODULES=(
   "lib/git/diff.sx"
   "lib/git/merge.sx"
   "lib/git/porcelain.sx"
+  "lib/datalog/tokenizer.sx"
+  "lib/datalog/parser.sx"
+  "lib/datalog/unify.sx"
+  "lib/datalog/db.sx"
+  "lib/datalog/builtins.sx"
+  "lib/datalog/aggregates.sx"
+  "lib/datalog/strata.sx"
+  "lib/datalog/eval.sx"
+  "lib/datalog/api.sx"
+  "lib/datalog/magic.sx"
+  "lib/acl/schema.sx"
+  "lib/acl/facts.sx"
+  "lib/acl/engine.sx"
   "lib/dream/types.sx"
   "lib/dream/router.sx"
   "lib/dream/middleware.sx"
   "lib/dream/error.sx"
   "lib/dream/html.sx"
   "lib/dream/json.sx"
+  "lib/dream/auth.sx"
   "lib/dream/api.sx"
   "lib/gitea/repo.sx"
+  "lib/gitea/access.sx"
   "lib/gitea/web.sx"
 )
 
@@ -72,7 +88,7 @@ run_suite() {
   } > "$TMP"
 
   local OUTPUT
-  OUTPUT=$(timeout 300 "$SX_SERVER" < "$TMP" 2>/dev/null)
+  OUTPUT=$(timeout 600 "$SX_SERVER" < "$TMP" 2>/dev/null)
   rm -f "$TMP"
 
   local LINE