Rename GITEA_ROTATION_TOKEN secret to ROTATION_PAT (GITEA_ prefix is reserved)

README.md

@@ -201,12 +201,14 @@ workflow write to its own repo's secrets):
 1. Create a Gitea personal access token with **write:repository** scope and
    **no expiration** (Settings -> Applications -> Generate New Token). This
    one doesn't rotate itself, so give it a long life up front.
-2. Add it as a repo/org Actions secret named `GITEA_ROTATION_TOKEN` (same
+2. Add it as a repo/org Actions secret named `ROTATION_PAT` (same
    Settings -> Actions -> Secrets page as above - if that tab is missing,
    see the nav-link workaround / API fallback in the "Auto-provisioning"
    section above, same `curl -X PUT .../actions/secrets/<name>` pattern,
-   just with `GITEA_ROTATION_TOKEN` as the secret name and the PAT itself as
-   the value).
+   just with `ROTATION_PAT` as the secret name and the PAT itself as the
+   value). Not named `GITEA_ROTATION_TOKEN` - Gitea reserves the `GITEA_`
+   prefix for its own automatic tokens/variables and rejects secrets with
+   that prefix (`Error: invalid variable or secret name`).
 
 After that, `CODER_SESSION_TOKEN` never needs manual attention again - you
 can also trigger a rotation on demand from Gitea's Actions tab