ci: push images to artifactapi registry instead of gitea

Hard switch of the docker push target from the Gitea registry to the
artifactapi local docker registry (docker-internal); the Gitea VM and its
registry are being retired. Drops the droneci/DRONECI_PASSWORD creds since
artifactapi accepts unauthenticated in-cluster pushes. Also updates the README image path.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

README.md

@@ -93,7 +93,7 @@ make test-short               # skip container-backed DB tests
 ## Releases
 
 - **`encapi` server image** — tagging `vX.Y.Z` builds and pushes
-  `git.unkin.net/unkin/encapi:{tag,latest}` (distroless).
+  `artifactapi.k8s.syd1.au.unkin.net/docker-internal/encapi:{tag,latest}` (distroless).
 - **`encapi-cli` RPM** — the same tag builds an RPM (nfpm) and publishes it to
   the ArtifactAPI `rpm-internal` repo. Installs `encapi-cli`, the `encapi-enc`
   Puppet wrapper, and `/etc/encapi/enc.conf`.