Check the organisation as well, because in Gitea the organisation wins

Setting the repository public changed nothing: /api/v1/orgs/DodoTech answers 404,
and a Gitea org's own visibility gates everything under it — a public repository
inside a Limited or Private org is invisible to anyone not signed in.

So 16.0 now checks both, and says which answer means which. It also names the
signal that tells this apart from an instance requiring sign-in for everything:
/explore/repos answering 200, which this one does, so what is hidden is hidden on
purpose rather than by policy.

docs/manual-checks.md

@@ -1790,11 +1790,25 @@ curl -so /dev/null -w '%{http_code}\n' https://git.dodotech.cloud/api/v1/repos/D
 
 **Pass:** `200`.
 
-**Failure means:** `404` is a private repository — Gitea does not distinguish "not there" from "not yours" —
+**Failure means:** `404` is a repository this caller may not see — Gitea does not distinguish "not there"
-and the clients read this address anonymously, because there is no token and deliberately nowhere to put
+from "not yours" — and the clients read this address anonymously, because there is no token and deliberately
-one. Every check on every machine will answer 404 and the feature cannot work. See
+nowhere to put one. Every check on every machine will answer 404 and the feature cannot work. See
 [ADR 0013 §4](adr/0013-desktop-distribution-and-updates.md).
 
+**And check the organisation before the repository, because the organisation wins.** A Gitea org has its own
+visibility, and a *public repository inside a Limited or Private org is invisible to anyone not signed in* —
+so setting the repository public and stopping there changes nothing. This is what it looks like:
+
+```bash
+curl -so /dev/null -w '%{http_code}
+' https://git.dodotech.cloud/api/v1/orgs/DodoTech
+```
+
+`404` there means the org is the gate; `200` means it is not and the repository itself is. Both must answer
+`200`. One more, which tells the two apart from an instance that requires sign-in for everything:
+`/explore/repos` answering `200` means anonymous browsing is on, so a repo that is still invisible is
+invisible on purpose rather than by instance policy.
+
 **Do not check `/api/v1/version` instead.** It answers `200` from a forge that is up regardless of what is
 readable on it, and that is exactly what made this look fine while nothing worked.