reports.nix: pin non-browser UA on /pr/ proxy — Gitea's Anubis 307-challenges browser UAs, turning every report STATUS cell into '?'

subagent model: opencode-go/deepseek-v4-flash (#37)

nix/modules/reports.nix

@@ -33,6 +33,10 @@ let
             proxy_ssl_server_name on;
             proxy_set_header Host git.autonomic.zone;
             proxy_set_header Accept "application/json";
+            # Pin a non-browser UA: Gitea sits behind Anubis, which 307-challenges browser-like
+            # UAs to an un-CORS-able counter-domain — which would turn every STATUS cell into "?".
+            # A stable non-browser UA passes through (verified: curl 200, browser UA 307).
+            proxy_set_header User-Agent "ccci-reports-proxy/1.0";
             proxy_pass https://git.autonomic.zone/api/v1/repos/recipe-maintainers/$1/pulls/$2;
             proxy_intercept_errors off;
             proxy_connect_timeout 5s;