Add support for listing all PRs targeting a repository

Implements client-side support for the new listPulls XRPC endpoint that
allows querying all PRs (from any author) targeting a specific repository.

Changes:
- Add list_repo_pulls() method to query PRs for a specific repo
- Add RepoPull struct for repo PR listing response
- Update pr list command to support --repo flag for listing all PRs
- Add PullSource struct to support branch-based PRs
- Make Pull.patch optional for compatibility with branch-based PRs
- Prevent merging branch-based PRs via CLI (requires web interface)
- Add TODO.md to track remaining technical debt

The pr list command now supports two modes:
- Without --repo: shows only PRs created by the authenticated user (legacy)
- With --repo: shows all PRs targeting the specified repository (new)

TODO.md

···
+# TODO - Tech Debt
+
+## Pull Request Support
+
+### Branch-Based PR Merge
+- [ ] Implement branch-based PR merge support in CLI
+  - **Issue**: Currently only patch-based PRs can be merged via `tangled pr merge`
+  - **Location**: `crates/tangled-api/src/client.rs:1250-1253`
+  - **Current behavior**: Returns error: "Cannot merge branch-based PR via CLI. Please use the web interface."
+  - **Required**: Add support for merging PRs that have a `source` field with SHA/branch info instead of a `patch` field
+  - **Related**: Server-side merge API may need updates to support branch merges
+
+### PR Comments Display
+- [ ] Implement `--comments` flag functionality in `pr show` command
+  - **Issue**: Flag is defined but not implemented
+  - **Location**: `crates/tangled-cli/src/commands/pr.rs:145-180`
+  - **Current behavior**: `tangled pr show <id> --comments` doesn't display any comments
+  - **Required**:
+    - Fetch comments from the API
+    - Display comment author, timestamp, and content
+    - Handle threaded/nested comments if supported
+  - **API**: Need to determine correct endpoint for fetching PR comments
+
+### PR Format Compatibility
+- [x] Support both patch-based and branch-based PR formats
+  - **Completed**: Added `PullSource` struct and made `patch` field optional
+  - **Location**: `crates/tangled-api/src/client.rs:1392-1413`
+  - **Details**: PRs can now have either:
+    - `patch: String` (legacy format)
+    - `source: { sha, repo?, branch? }` (new format)
+
+## Related Issues
+
+- Consider adding `--format json` output for programmatic access to PR data
+- Add better error messages when operations aren't supported for certain PR types
+- Document the differences between patch-based and branch-based PRs in user docs

crates/tangled-api/src/client.rs

···
         Ok(out)
     }
 
+    pub async fn list_repo_pulls(
+        &self,
+        repo_at: &str,
+        state: Option<&str>,
+        pds_base: &str,
+        access_jwt: &str,
+    ) -> Result<Vec<RepoPull>> {
+        let sa = self.service_auth_token(pds_base, access_jwt).await?;
+
+        #[derive(Deserialize)]
+        struct Res {
+            pulls: Vec<RepoPull>,
+        }
+
+        let mut params = vec![("repo", repo_at.to_string())];
+        if let Some(s) = state {
+            params.push(("state", s.to_string()));
+        }
+
+        let res: Res = self
+            .get_json("sh.tangled.repo.listPulls", &params, Some(&sa))
+            .await?;
+        Ok(res.pulls)
+    }
+
     #[allow(clippy::too_many_arguments)]
     pub async fn create_pull(
         &self,
···
             Some(pull.body.as_str())
         };
 
+        // For now, only patch-based PRs can be merged via CLI
+        // Branch-based PRs need to be merged via the web interface
+        let patch_str = pull.patch.as_deref()
+            .ok_or_else(|| anyhow!("Cannot merge branch-based PR via CLI. Please use the web interface."))?;
+
         let req = MergeReq {
             did: repo_did,
             name: repo_name,
-            patch: &pull.patch,
+            patch: patch_str,
             branch: &pull.target.branch,
             commit_message: Some(&pull.title),
             commit_body,
···
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PullSource {
+    pub sha: String,
+    #[serde(default)]
+    pub repo: Option<String>,
+    #[serde(default)]
+    pub branch: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Pull {
     pub target: PullTarget,
     pub title: String,
     #[serde(default)]
     pub body: String,
-    pub patch: String,
+    #[serde(default)]
+    pub patch: Option<String>,
+    #[serde(default)]
+    pub source: Option<PullSource>,
     #[serde(rename = "createdAt")]
     pub created_at: String,
 }
···
     pub author_did: String,
     pub rkey: String,
     pub pull: Pull,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct RepoPull {
+    pub rkey: String,
+    #[serde(rename = "ownerDid")]
+    pub owner_did: String,
+    #[serde(rename = "pullId")]
+    pub pull_id: i32,
+    pub title: String,
+    pub state: i32,
+    #[serde(rename = "targetBranch")]
+    pub target_branch: String,
+    #[serde(rename = "createdAt")]
+    pub created_at: String,
 }
 
 #[derive(Debug, Clone)]

crates/tangled-cli/src/commands/pr.rs

···
         .or_else(|| std::env::var("TANGLED_PDS_BASE").ok())
         .unwrap_or_else(|| "https://bsky.social".into());
     let client = tangled_api::TangledClient::new(&pds);
-    let target_repo_at = if let Some(repo) = &args.repo {
+
+    // NEW: If --repo is specified, use the new API to list all PRs for that repo
+    if let Some(repo) = &args.repo {
         let (owner, name) = parse_repo_ref(repo, &session.handle);
         let info = client
             .get_repo_info(owner, name, Some(session.access_jwt.as_str()))
             .await?;
-        Some(format!("at://{}/sh.tangled.repo/{}", info.did, info.rkey))
-    } else {
-        None
-    };
-    let pulls = client
-        .list_pulls(
-            &session.did,
-            target_repo_at.as_deref(),
-            Some(session.access_jwt.as_str()),
-        )
-        .await?;
-    if pulls.is_empty() {
-        println!("No pull requests found (showing only those you created)");
+        let repo_at = format!("at://{}/sh.tangled.repo/{}", info.did, info.rkey);
+
+        // Use Tangled API (tngl.sh) instead of PDS for aggregated query
+        let api_client = tangled_api::TangledClient::default();
+        let state = args.state.as_deref();
+        let pulls = api_client
+            .list_repo_pulls(&repo_at, state, &pds, &session.access_jwt)
+            .await?;
+
+        if pulls.is_empty() {
+            println!("No pull requests found for this repository");
+        } else {
+            println!("OWNER\tID\tTITLE\tSTATE");
+            for pr in pulls {
+                let state_str = match pr.state {
+                    1 => "open",
+                    0 => "closed",
+                    2 => "merged",
+                    _ => "unknown",
+                };
+                println!("{}\t{}\t{}\t{}", pr.owner_did, pr.pull_id, pr.title, state_str);
+            }
+        }
     } else {
-        println!("RKEY\tTITLE\tTARGET");
-        for pr in pulls {
-            println!("{}\t{}\t{}", pr.rkey, pr.pull.title, pr.pull.target.repo);
+        // OLD: Without --repo, show only user's PRs (existing behavior)
+        let pulls = client
+            .list_pulls(
+                &session.did,
+                None,
+                Some(session.access_jwt.as_str()),
+            )
+            .await?;
+        if pulls.is_empty() {
+            println!("No pull requests found (showing only those you created)");
+        } else {
+            println!("RKEY\tTITLE\tTARGET");
+            for pr in pulls {
+                println!("{}\t{}\t{}", pr.rkey, pr.pull.title, pr.pull.target.repo);
+            }
         }
     }
     Ok(())
···
         println!("BODY:\n{}", pr.body);
     }
     println!("TARGET: {} @ {}", pr.target.repo, pr.target.branch);
+
+    // Display source info if it's a branch-based PR
+    if let Some(source) = &pr.source {
+        println!("SOURCE: {} ({})", source.sha,
+            source.branch.as_deref().unwrap_or("detached"));
+        if let Some(repo) = &source.repo {
+            println!("SOURCE REPO: {}", repo);
+        }
+    }
+
     if args.diff {
-        println!("PATCH:\n{}", pr.patch);
+        if let Some(patch) = &pr.patch {
+            println!("PATCH:\n{}", patch);
+        } else {
+            println!("(No patch available - this is a branch-based PR)");
+        }
     }
     Ok(())
 }