ci: use PAT for Gitea registry authentication

Switch from the automatic GITHUB_TOKEN to a Personal Access Token to resolve unauthorized errors when writing packages to the Gitea registry.

.gitea/workflows/docker-publish.yml

@@ -48,10 +48,10 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: ${{ env.GITEA_REGISTRY }}
-          username: ${{ github.actor }}
+          # The automatic per-job token comes back unauthorized for package
-          # Gitea's per-job token; grant it package write access, or swap
+          # writes on this instance, so use a PAT (scope: write:package) instead.
-          # this for a PAT secret if your instance doesn't wire that up.
+          username: ${{ secrets.GITEA_USERNAME }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.GITEA_TOKEN }}
 
       - name: Log in to GHCR
         uses: docker/login-action@v3