CI: log in to registry with REGISTRY_USERNAME/REGISTRY_TOKEN secrets

The automatic GITEA_TOKEN has no write:package scope, so docker login to
git.rambossek.at failed with unauthorized.

SPEC.md

@@ -185,8 +185,10 @@ are new.
      available in the runner image
   2. on a version tag only (`vX.Y.Z`, enforced): build the image with buildx
      and push it to the Gitea registry
-     `git.rambossek.at/<owner>/gpu-turnstile` tagged `:<tag>` and `:latest`,
-     using the workflow token (`${{ secrets.GITEA_TOKEN }}` / `gitea.actor`)
+     `git.rambossek.at/<owner>/gpu-turnstile` tagged `:<tag>` and `:latest`.
+     Login uses the repo secrets `REGISTRY_USERNAME` / `REGISTRY_TOKEN` (an
+     access token with `write:package` scope) because the automatic
+     `GITEA_TOKEN` cannot push packages.
 - Release: a git tag `vX.Y.Z` produces the versioned image; the Open WebUI
   compose pins that tag. No images are built from branches.