Separate local vs remote Gitea API tokens to prevent credential collision

GITEA_API_TOKEN is for the local platform Gitea (docs comments, user
provisioning, SSO). New GITEA_REGISTRY_API_TOKEN is for the remote
registry at gitea.bnkops.com (release uploads via build-release.sh).

Previously both contexts shared one variable, causing auth failures
when the token for one instance was used against the other.

Bunker Admin

.env.example

@@ -212,8 +212,12 @@ COMPOSE_PROFILES=
 # For docker push/pull, run: docker login gitea.bnkops.com
 GITEA_REGISTRY_USER=admin
 GITEA_REGISTRY_PASS=
+# API token for the REMOTE registry (gitea.bnkops.com) — used by build-release.sh --upload
+# Create at: https://gitea.bnkops.com/user/settings/applications
+# This is NOT the same as GITEA_API_TOKEN (which is for the local platform Gitea below)
+GITEA_REGISTRY_API_TOKEN=
 
-# --- Gitea ---
+# --- Gitea (Local Platform Instance) ---
 GITEA_URL=http://gitea-changemaker:3000
 GITEA_PORT=3030
 GITEA_WEB_PORT=3030
@@ -230,7 +234,9 @@ GITEA_DOMAIN=git.cmlite.org
 # --- Gitea Docs Comments ---
 # Enable comments on MkDocs pages (backed by Gitea Issues)
 GITEA_COMMENTS_ENABLED=false
-# Personal access token with repo write scope (create in Gitea → Settings → Applications)
+# Personal access token for the LOCAL Gitea instance (docs comments, user provisioning, SSO)
+# Create at: http://localhost:3030/user/settings/applications (or https://git.DOMAIN/...)
+# This is NOT the same as GITEA_REGISTRY_API_TOKEN (which is for the remote registry above)
 GITEA_API_TOKEN=
 # Repository owner (Gitea username that will own the docs-comments repo)
 GITEA_COMMENTS_REPO_OWNER=