fix(ci): authenticate registry push with package-scoped REGISTRY_TOKEN

The auto GITEA_TOKEN has no package-registry scope, so docker login to
gitea.leeworks.dev returned 'unauthorized'. Use a dedicated PAT (REGISTRY_TOKEN,
write:package) with the token-owner username. Helper script now mints both
SIBLING_REPOS_TOKEN and REGISTRY_TOKEN from one password prompt.

.gitea/workflows/build-docs.yaml

@@ -98,9 +98,14 @@ jobs:
         # Use Gitea's built-in container registry (gitea.leeworks.dev), which
         # has a valid Let's Encrypt cert. The standalone registry.leeworks.dev
         # serves Traefik's default self-signed cert and fails TLS verification.
+        #
+        # Auth uses REGISTRY_TOKEN, NOT the auto GITEA_TOKEN: the auto token has
+        # no package-registry scope, and the registry requires the username to
+        # match the token owner. REGISTRY_TOKEN must be a PAT (owner: 0xWheatyz)
+        # with write:package + read:package scope.
         run: |
-          echo "${{ secrets.GITEA_TOKEN }}" | docker login gitea.leeworks.dev \
-            -u ${{ gitea.actor }} --password-stdin
+          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea.leeworks.dev \
+            -u 0xWheatyz --password-stdin
 
       - name: Build and push docs-site image
         working-directory: api-company/docs-site