ci: use mozempk registry secrets + buildkit npm secret (align with insta-recipe)

The OVH org-level secrets/vars don't follow the repo on transfer; switch to the
mozempk user-level REGISTRY_USERNAME/REGISTRY_TOKEN and pass the npm read token as
a BuildKit secret so 'npm ci' can resolve @mozempk/ig-auth.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/build_publish.yaml

@@ -6,6 +6,10 @@ on:
     branches:
       - 'master'
 
+env:
+  REGISTRY: git.sal.giize.com
+  IMAGE_NAME: mozempk/generic-video-dl
+
 jobs:
   build_images:
     name: Build and push image to Gitea's registry
@@ -18,29 +22,21 @@ jobs:
 
       - uses: docker/setup-buildx-action@v3
 
-      - uses: docker/login-action@v3.1.0
+      - uses: docker/login-action@v3
         with:
-          registry: ${{ vars.hostname_gitea }}
-          username: mozempk
-          password: ${{ secrets.REGISTRY_GITEA_TOKEN }}
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
-      - id: meta_app
-        uses: docker/metadata-action@v5.5.1
-        with:
-          tags: |
-            type=raw,enable=true,priority=200,prefix=,suffix=,value=latest
-          images: ${{ vars.hostname_gitea }}/${{ gitea.repository }}
-
-      - uses: docker/build-push-action@v5.3.0
+      - uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
           push: true
-          tags: ${{ steps.meta_app.outputs.tags }}
-          labels: ${{ steps.meta_app.outputs.labels }}
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
           # read token for the @mozempk/ig-auth scoped registry (npm ci)
           secrets: |
-            gitea_npm=${{ secrets.REGISTRY_GITEA_TOKEN }}
+            gitea_npm=${{ secrets.REGISTRY_TOKEN }}
 
   # Deploy is manual on ideapad (matches the repo convention): once the image is
   # published, on ideapad run: