ci: read WATCHTOWER_TOKEN from vars, not secrets

The token is stored as an instance-level Actions Variable
(Site Administration > Actions > Variables), not a Secret. secrets.WATCHTOWER_TOKEN
always resolved to empty, so the watchtower trigger request carried
no Authorization value and was rejected (401 Invalid token attempt).

.gitea/workflows/docker.yaml

@@ -30,6 +30,6 @@ jobs:
       - name: 🔔 Trigger Watchtower
         if: github.ref == 'refs/heads/main'
         env:
-          TOKEN: ${{ secrets.WATCHTOWER_TOKEN }}
+          TOKEN: ${{ vars.WATCHTOWER_TOKEN }}
         run: |
           curl -X POST -H "Authorization: Bearer $TOKEN" http://192.168.1.118:3026/v1/update