fix: secrets de registry sem prefixo GITEA_

Gitea rejeita nomes de secret reservados GITEA_*; workflows
e runbook passam a REGISTRY_PAT / REGISTRY_USER.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/deploy-staging.yml

@@ -49,8 +49,8 @@ jobs:
           registry: ${{ env.REGISTRY }}
           # Gitea's GITEA_TOKEN cannot push OCI packages (gitea#23642); a PAT
           # with read:package/write:package scopes is required instead.
-          username: ${{ secrets.GITEA_REGISTRY_USER }}
+          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.GITEA_PAT }}
+          password: ${{ secrets.REGISTRY_PAT }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3

.gitea/workflows/promote-production.yml

@@ -56,8 +56,8 @@ jobs:
           registry: ${{ env.REGISTRY }}
           # Gitea's GITEA_TOKEN cannot push OCI packages (gitea#23642); a PAT
           # with read:package/write:package scopes is required instead.
-          username: ${{ secrets.GITEA_REGISTRY_USER }}
+          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.GITEA_PAT }}
+          password: ${{ secrets.REGISTRY_PAT }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3

docs/deployment/dokploy.md

@@ -33,7 +33,7 @@ Promote (manual) → retag same digest as :production (no rebuild)
 5. Two R2 buckets (or prefixes) and Resend credentials for each environment as needed.
 6. Domains (or temporary Dokploy/traefik.me hosts) pointing at the VPS with TLS.
 
-Note: Gitea's `GITEA_TOKEN` cannot push OCI packages ([gitea#23642](https://github.com/go-gitea/gitea/issues/23642)); registry authentication in the workflows uses a PAT (`GITEA_PAT`), not the token.
+Note: Gitea's `GITEA_TOKEN` cannot push OCI packages ([gitea#23642](https://github.com/go-gitea/gitea/issues/23642)); registry authentication in the workflows uses a PAT (`REGISTRY_PAT`), not the token. Secret names must not use the reserved `GITEA_` prefix (Gitea rejects them as invalid).
 
 ## Create Compose stacks
 
@@ -135,12 +135,12 @@ Repository secrets (Gitea → Settings → Actions → Secrets) used by workflow
 | `DOKPLOY_PRODUCTION_COMPOSE_ID` | Production **Compose** service id (not an Application id) |
 | `STAGING_URL` | Public origin for staging smoke (e.g. `https://staging.example.com`) |
 | `PRODUCTION_URL` | Public origin for production smoke |
-| `GITEA_PAT` | Personal Access Token with `read:package` + `write:package` scopes — used to push images to `git.hellomanoel.com` |
+| `REGISTRY_PAT` | Personal Access Token with `read:package` + `write:package` scopes — used to push images to `git.hellomanoel.com` (do not name secrets `GITEA_*`; that prefix is reserved) |
-| `GITEA_REGISTRY_USER` | Gitea username that owns `GITEA_PAT` (`manoel-freitas`) |
+| `REGISTRY_USER` | Gitea username that owns `REGISTRY_PAT` (`manoel-freitas`) |
 
 HTTP 404 from `compose.deploy` usually means the compose id is wrong (Application id instead of Compose) or `DOKPLOY_URL` still includes `/api`.
 
-The automatic `GITEA_TOKEN` runs workflows but **cannot push OCI packages** ([gitea#23642](https://github.com/go-gitea/gitea/issues/23642)); registry authentication therefore uses `GITEA_PAT` + `GITEA_REGISTRY_USER`. No Laravel/`APP_KEY`/DB/R2/Resend secrets belong in Gitea for this pipeline.
+The automatic `GITEA_TOKEN` runs workflows but **cannot push OCI packages** ([gitea#23642](https://github.com/go-gitea/gitea/issues/23642)); registry authentication therefore uses `REGISTRY_PAT` + `REGISTRY_USER`. No Laravel/`APP_KEY`/DB/R2/Resend secrets belong in Gitea for this pipeline.
 
 ## Workflows