ci: authenticate registry with REGISTRY_TOKEN secret

Use an explicit Gitea token (write:package scope) instead of the
built-in job token for docker login.

.gitea/workflows/build-and-push.yaml

@@ -4,8 +4,9 @@ name: build-and-push
 # Gitea container registry. Argo CD then rolls them out via
 # deploy/helm/pargar (values-apollo.yaml pins the matching image tags).
 #
-# Requires a registered Gitea Actions runner and `permissions.packages: write`
-# so the built-in job token (secrets.GITEA_TOKEN) can push to the registry.
+# Requires a registered Gitea Actions runner, a `REGISTRY_TOKEN` secret
+# (Gitea access token with write:package scope) so docker login can push to
+# the registry.
 
 on:
   push:
@@ -56,7 +57,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          password: ${{ secrets.GITEA_TOKEN }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push backend
         uses: docker/build-push-action@v6