Separate local vs remote Gitea API tokens to prevent credential collision

GITEA_API_TOKEN is for the local platform Gitea (docs comments, user
provisioning, SSO). New GITEA_REGISTRY_API_TOKEN is for the remote
registry at gitea.bnkops.com (release uploads via build-release.sh).

Previously both contexts shared one variable, causing auth failures
when the token for one instance was used against the other.

Bunker Admin

scripts/build-release.sh

@@ -198,14 +198,16 @@ success "Created: $TARBALL (${TARBALL_SIZE})"
 # --- Upload to Gitea (optional) ---
 if [[ "$UPLOAD" == "true" ]]; then
   source "$PROJECT_DIR/.env" 2>/dev/null || true
-  GITEA_TOKEN="${GITEA_API_TOKEN:-}"
+  # GITEA_REGISTRY_API_TOKEN is for the remote registry (gitea.bnkops.com)
+  # GITEA_API_TOKEN is for the local platform Gitea — do NOT use it here
+  GITEA_TOKEN="${GITEA_REGISTRY_API_TOKEN:-}"
   # GITEA_URL is the internal Docker hostname — use GITEA_REGISTRY for external access
   GITEA_REGISTRY_HOST="${GITEA_REGISTRY%%/*}"  # strip /admin path → gitea.bnkops.com
   GITEA_HOST="${GITEA_EXTERNAL_URL:-https://${GITEA_REGISTRY_HOST:-gitea.bnkops.com}}"
 
   if [[ -z "$GITEA_TOKEN" ]]; then
-    warn "GITEA_API_TOKEN not set — skipping upload"
-    warn "Set GITEA_API_TOKEN in .env and re-run with --upload"
+    warn "GITEA_REGISTRY_API_TOKEN not set — skipping upload"
+    warn "Set GITEA_REGISTRY_API_TOKEN in .env and re-run with --upload"
   else
     info "Creating Gitea release ${TAG}..."
     RELEASE_RESPONSE=$(curl -sf -X POST \