ci: use Gitea's built-in GITEA_TOKEN for registry push, drop manual PAT

GITEA_PACKAGE_TOKEN was never a creatable secret name (GITEA_ prefix is
reserved), and Gitea Actions' built-in token can be granted registry
write access directly via `permissions: packages: write` (per
https://docs.gitea.com/usage/actions/token-permissions/) - the
"unauthorized: reqPackageAccess" issue noted earlier looks to have been
exactly this: the default restricted token mode denying package write
unless a job explicitly requests it, not an unfixable bug in the token
itself. Drops the manual-PAT requirement entirely - no secret to create
or maintain.

.gitea/workflows/coder-templates.yml

@@ -13,12 +13,12 @@ name: Provision Coder Templates
 #   CODER_URL             e.g. https://code.octoturge.com
 #   CODER_SESSION_TOKEN   a token from `coder tokens create`, ideally under a
 #                          dedicated service account rather than a personal one
-#   GITEA_PACKAGE_TOKEN   a Gitea access token (user Settings > Applications)
-#                          with write:package scope, for pushing each
-#                          Dockerfile-having template's image to this
-#                          instance's container registry. Only the octoturge
-#                          account's own token is used - docker login below
-#                          hardcodes that username to match.
+#
+# Pushing each Dockerfile-having template's image to this instance's
+# container registry uses Gitea's own built-in secrets.GITEA_TOKEN (no
+# manually-created PAT needed) - build-images grants it write access via
+# `permissions: packages: write` below. See
+# https://docs.gitea.com/usage/actions/token-permissions/
 #
 # Any templates/<env>/ that has its own Dockerfile gets its image built and
 # pushed here (build-images, on the dedicated "docker-build" runner - see
@@ -49,6 +49,11 @@ jobs:
     # container.volumes mount for the same path here fails at container
     # creation with "Duplicate mount point: /var/run/docker.sock".
     runs-on: docker-build
+    # The default token permission mode denies package write unless a job
+    # explicitly asks for it - without this, docker push fails with
+    # "unauthorized: reqPackageAccess".
+    permissions:
+      packages: write
     outputs:
       failed_templates: ${{ steps.build.outputs.failed_templates }}
     # docker:27-cli (Alpine) has no bash - only the POSIX /bin/sh (busybox
@@ -74,7 +79,7 @@ jobs:
         id: build
         run: |
           set -e
-          echo "${{ secrets.GITEA_PACKAGE_TOKEN }}" | docker login git.octoturge.com -u octoturge --password-stdin
+          echo "${{ secrets.GITEA_TOKEN }}" | docker login git.octoturge.com -u "${{ github.actor }}" --password-stdin
 
           FAILED=""
           for dockerfile in templates/*/Dockerfile; do