ci: push images to artifactapi registry instead of gitea

Hard switch of the docker push target from the Gitea registry to the
artifactapi local docker registry (docker-internal); the Gitea VM and its
registry are being retired. Drops the droneci/DRONECI_PASSWORD creds since
artifactapi accepts unauthenticated in-cluster pushes. Also updates the README image path.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

.woodpecker/docker.yaml

@@ -1,7 +1,7 @@
 # Build and push the pdbmux container image on a v* tag. pdbmux is a k8s-only
 # daemon (deployed via argocd-apps), so it ships as an image. Mirrors the estate
-# convention: the woodpeckerci/plugin-docker-buildx plugin pushes to the Gitea
-# registry using the droneci / DRONECI_PASSWORD credentials.
+# convention: the woodpeckerci/plugin-docker-buildx plugin pushes to the
+# artifactapi local docker registry (unauthenticated in-cluster push).
 when:
   - event: tag
     ref: refs/tags/v*
@@ -10,14 +10,11 @@ steps:
   - name: docker
     image: woodpeckerci/plugin-docker-buildx
     settings:
-      registry: git.unkin.net
-      repo: git.unkin.net/unkin/pdbmux
+      registry: artifactapi.k8s.syd1.au.unkin.net
+      repo: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux
       dockerfile: Dockerfile
       build_args:
         VERSION: ${CI_COMMIT_TAG}
-      username: droneci
-      password:
-        from_secret: DRONECI_PASSWORD
       tags:
         - ${CI_COMMIT_TAG}
         - latest

README.md

@@ -124,7 +124,7 @@ estate direction — it is not shipped as a per-VM RPM/systemd service. The imag
 is built and pushed on every `v*` tag (`.woodpecker/docker.yaml`) to:
 
 ```
-git.unkin.net/unkin/pdbmux:<tag>
+artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:<tag>
 ```
 
 It is a minimal static (`CGO_ENABLED=0`) binary on a distroless base