fix(ci): use PACKAGES_TOKEN PAT for docker registry auth

The auto-injected GITEA_TOKEN does not have effective write access to
the container registry on Gitea 1.26 even with `permissions: packages:
write` set. Switching to a dedicated PAT (write:package scope) stored
as the PACKAGES_TOKEN repo secret.

Bumps version to 1.2.3 to trigger a fresh tag-build.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pdga-ratings",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pdga-ratings",
-      "version": "1.2.2",
+      "version": "1.2.3",
       "dependencies": {
         "ejs": "^4.0.1",
         "express": "^4.18.2",