fix: use env vars for docker registry credentials

Pass FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN via environment
variables instead of direct secret interpolation. This is the standard
approach used across all repos and prevents credentials from being exposed
in logs or shell history.

Fixes registry login failures by using the proven pattern.

.gitea/workflows/ci.yaml

@@ -41,18 +41,14 @@ jobs:
     runs-on: golang
     steps:
       - name: Install Node.js and Docker
-        run: |
-          apt-get update
-          apt-get install -y nodejs docker.io
+        run: apt-get update && apt-get install -y nodejs docker.io
 
       - name: Checkout code
         uses: actions/checkout@v4
 
       - name: Get short SHA
         id: sha
-        run: |
-          SHORT_SHA=$(git rev-parse --short HEAD)
-          echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+        run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
 
       - name: Registry login
         run: |
@@ -62,7 +58,7 @@ jobs:
           REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
           REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
 
-      - name: Build Docker image
+      - name: Build and push image
         run: |
           docker build --no-cache \
             -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \