[meddlin]

What changed

The Repositories page now has Combined, Local, GitHub and GitLab tabs (kept in the URL as ?source=), so the app is no longer limited to local clones when hosted on a server.

• Combined (default) joins each local clone with the GitHub/GitLab repos its remotes point at. One row shows where a project lives (clone, GitHub, GitLab) and what it is missing; clones of the same remote collapse into one row.
• Local is the existing full table, unchanged (favorites, descriptions, issue counts, community scores, preview pane).
• GitHub / GitLab list what each host reports for the configured account, with links out; cloned repos open their detail page.
• GitHub uses the existing GITLIB_GITHUB_TOKEN. GitLab uses a new optional GITLIB_GITLAB_TOKEN (read_api, member projects), or GITLIB_GITLAB_USERNAME for public projects, plus GITLIB_GITLAB_URL if self-hosted.

Why stored lists, not fetched per view

Host lists are saved in a new remote_repo_listings table in gitlib.db and read from there, so a page load never calls GitHub or GitLab and the lists survive restarts.

• The server re-checks a host in the background when its list is missing or older than GITLIB_REPO_REFRESH_HOURS (default 6, 0 = only the Refresh button), on page load and via a 15-minute timer.
• Checks send each page's ETag; a 304 reuses the stored page and costs no GitHub quota. Refresh ignores ETags and fetches complete lists.
• A failed check (bad token, rate limit) keeps the stored list on screen with the error noted and pauses automatic retries for 30 minutes.
• A stored list for a different host/account (e.g. changed GITLIB_GITLAB_URL) is ignored.

Notes for reviewers

• Catalog logic lives in catalog.server.ts; catalog.ts only holds the server functions. Exporting logic from the server-function file leaked server-only code into the client bundle, so keep them split.
• Merging is a pure function in apps/web/src/lib/catalog.ts (union-find over remote keys). Only a clone's preferred remote per host is followed, so a fork's upstream isn't pulled in.
• gitlib.db is included in backups, so the stored lists (including private repo names) will be too.
• Not built: detail page or preview pane for remote-only repos, sorting on the remote tabs (alphabetical only), and linking a GitHub/GitLab mirror pair that has no clone with both remotes.

Testing

• npm test (220 tests) and the web typecheck pass. New tests cover the merge logic, GitHub/GitLab paging and ETag revalidation (with fetch stubbed), the store table, and the full flow: first load, restart, recheck, failure, interval 0.
• Checked in the browser with no tokens (fallback from clone remotes, setup notices) and with an invalid GitHub token (clear 401 notice, page still works).
• Not run against a real GitHub or GitLab account; the live listing and 304 paths are covered only by the stubbed tests.