# DEVX-164: auto-merge resilience — self-approval and Vikunja outage handling

## Problem

Two defects hit auto-merge during S02 work:

1. `get_vikunja_task_title` crashes on transient Vikunja errors. The
   Vikunja API returned 404/502 during a restart window (run 6093);
   `list_project_tasks` treats 4xx as non-retryable `APIError`, so the
   job failed immediately instead of riding out a short outage.
2. When a PR author and the workflow's reviewer token map to the same
   Gitea user, the auto-approve step is rejected ("approve your own
   pull is not allowed") and the merge fails `405: not enough
   approvals`. The generic merge error gives no hint that an external
   approval is the fix (hit on sso-bridge #18, #19, and infra #1647's
   approvals-only failure mode).

## Approach

REQ-1: Wrap the task-list pagination in `get_vikunja_task_title` with a
bounded retry (tenacity, ~4 attempts, exponential backoff) covering
`APIError` and `requests.RequestException`. A genuinely missing task
still ends in the same "Could not find" ClickException.

REQ-2: On merge `HTTP 405`, fetch PR reviews; when zero `APPROVED`
reviews exist, extend the error with the self-approval explanation and
the remediation (approve via a non-author account).

REQ-3: Regression tests for both behaviors.

## Files Affected

- `src/devx/ci/auto_merge.py`
- `tests/unit/test_auto_merge.py`

## Test Plan

- New tests: retry-then-success on transient APIError; retry-exhaustion
  still raises; missing task still raises; 405 error includes
  approvals diagnostic.
- `make pytest-cov`, `make lint-all`.

## Deploy Plan

- Merge → next release publishes the package; consuming repos pick it
  up on their next CI run (devx is pinned per-repo, bump via the usual
  dependency PR flow).

## Rollback Plan

- Revert; previous behavior returns.

## Acceptance Criteria

- [x] REQ-1: Vikunja task-list retries transient API failures
- [x] REQ-2: 405 merge error reports approval state + self-approval hint
- [x] REQ-3: Regression tests added and passing