Use an explicit Gitea token (write:package scope) instead of the built-in job token for docker login.