fix: use explicit Gitea registry credentials

.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Sign in to the Gitea Container Registry
-        run: echo "${{ secrets.GITEA_TOKEN }}" | docker login gitea.blyzer.com.br -u "${{ gitea.actor }}" --password-stdin
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login gitea.blyzer.com.br -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
       - name: Build and publish API
         run: |
           docker build --pull -f Dockerfile.api -t gitea.blyzer.com.br/blyzer/compor-academy-api:latest .

PORTAINER.md

@@ -4,6 +4,15 @@ Use `docker-compose.yml` as a Portainer Stack from this repository. It deploys t
 
 This is a Docker Swarm stack: Portainer pulls prebuilt API and web images from the Gitea Container Registry. It never builds Dockerfiles itself.
 
+## Gitea Actions registry secrets
+
+Create these repository-level Action secrets in Gitea before pushing to `main`:
+
+- `REGISTRY_USERNAME`: the Gitea username that owns a package-write token.
+- `REGISTRY_TOKEN`: a Gitea personal access token for that user with package read/write permission.
+
+The built-in Actions job token can be disabled or lack registry scope on self-hosted Gitea instances, so the image publishing job intentionally uses these explicit secrets.
+
 ## Required Portainer environment variables
 
 - `POSTGRES_PASSWORD`: a long, unique database password. Avoid characters that are not URL-safe because it is used in `DATABASE_URL`.