fix(ci): auth to registry with a PAT instead of the built-in token

The auto-injected GITHUB_TOKEN isn't authorized against this Gitea
instance's container registry (401 unauthorized), so use a repo
secret backed by a personal access token with package scope instead.

.gitea/workflows/docker-publish.yml

@@ -22,7 +22,7 @@ jobs:
         with:
           registry: ${{ vars.REGISTRY_HOST }}
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push
         uses: docker/build-push-action@v6