CI: log in to registry with REGISTRY_USERNAME/REGISTRY_TOKEN secrets

The automatic GITEA_TOKEN has no write:package scope, so docker login to
git.rambossek.at failed with unauthorized.

README.md

@@ -73,6 +73,10 @@ runs `go vet` and `go test -race`, and pushing a semantic-version tag
 `git.rambossek.at/<owner>/gpu-turnstile:vX.Y.Z` (and updates `:latest`).
 No images are built from branches.
 
+The registry login needs two repository secrets (Settings → Actions →
+Secrets): `REGISTRY_USERNAME` and `REGISTRY_TOKEN` — an access token with
+`write:package` scope. The automatic `GITEA_TOKEN` cannot push packages.
+
 ## Development
 
 ```sh