fix: use CI_JOB_TOKEN for GitLab MR comments to match docs

The docs promise no extra token setup — only ANTHROPIC_API_KEY and
ELEMENTARY_API_KEY. Revert to CI_JOB_TOKEN which is automatic.
Requires the project setting "Allow CI/CD job tokens to access API".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: joostboon

scripts/review.sh

@@ -138,7 +138,7 @@ function api(method, reqUrl, data) {
   if (existingId) {
     const updateUrl = updateTpl.replace("{id}", String(existingId));
     // GitHub uses PATCH, GitLab uses PUT
-    const method = authName === "PRIVATE-TOKEN" ? "PUT" : "PATCH";
+    const method = authName === "JOB-TOKEN" ? "PUT" : "PATCH";
     await api(method, updateUrl, { body });
     console.log(`Updated existing comment (id: ${existingId})`);
   } else {

templates/mr-review.yml

@@ -41,8 +41,8 @@ elementary-mr-review:
       export POST_COMMENT_URL="${CI_SERVER_URL}/api/v4/projects/${CI_PROJECT_ID}/merge_requests/${CI_MERGE_REQUEST_IID}/notes"
       export LIST_COMMENTS_URL="${CI_SERVER_URL}/api/v4/projects/${CI_PROJECT_ID}/merge_requests/${CI_MERGE_REQUEST_IID}/notes"
       export UPDATE_COMMENT_URL_TPL="${CI_SERVER_URL}/api/v4/projects/${CI_PROJECT_ID}/merge_requests/${CI_MERGE_REQUEST_IID}/notes/{id}"
-      export AUTH_HEADER_NAME="PRIVATE-TOKEN"
-      export AUTH_HEADER_VALUE="${GITLAB_API_TOKEN}"
+      export AUTH_HEADER_NAME="JOB-TOKEN"
+      export AUTH_HEADER_VALUE="${CI_JOB_TOKEN}"
       export CLAUDE_MODEL="${ELEMENTARY_CI_CLAUDE_MODEL:-claude-haiku-4-5}"
 
       SCRIPT_TAG="${ELEMENTARY_CI_SCRIPT_TAG:-v1}"