fix: use explicit Gitea registry credentials

PORTAINER.md

@@ -4,6 +4,15 @@ Use `docker-compose.yml` as a Portainer Stack from this repository. It deploys t
 
 This is a Docker Swarm stack: Portainer pulls prebuilt API and web images from the Gitea Container Registry. It never builds Dockerfiles itself.
 
+## Gitea Actions registry secrets
+
+Create these repository-level Action secrets in Gitea before pushing to `main`:
+
+- `REGISTRY_USERNAME`: the Gitea username that owns a package-write token.
+- `REGISTRY_TOKEN`: a Gitea personal access token for that user with package read/write permission.
+
+The built-in Actions job token can be disabled or lack registry scope on self-hosted Gitea instances, so the image publishing job intentionally uses these explicit secrets.
+
 ## Required Portainer environment variables
 
 - `POSTGRES_PASSWORD`: a long, unique database password. Avoid characters that are not URL-safe because it is used in `DATABASE_URL`.