docs: note that GITEA_TOKEN impersonates the pushing account, not the owner

Documents what we just found the hard way: build-images's docker push
runs as whichever Gitea account authenticated the triggering push
(github.actor), which needs its own package-registry write access -
separate from that account having git push rights to the repo at all.

.gitea/workflows/coder-templates.yml

@@ -20,6 +20,13 @@ name: Provision Coder Templates
 # `permissions: packages: write` below. See
 # https://docs.gitea.com/usage/actions/token-permissions/
 #
+# GITEA_TOKEN impersonates whoever authenticated the triggering push
+# (github.actor), not necessarily the repo owner - that account needs
+# write access to this repo's package registry itself, separate from
+# having git push access to the repo. A push authenticated as an account
+# without registry access fails at docker login with a plain
+# "unauthorized" (not a token/config problem).
+#
 # Any templates/<env>/ that has its own Dockerfile gets its image built and
 # pushed here (build-images, on the dedicated "docker-build" runner - see
 # templates/web/main.tf for why: that runner is scoped to this repo only and