ci: unify REGISTRY_TOKEN + RELEASE_TOKEN into a single CI_TOKEN secret

Both prior secrets did related work (one for registry push, one for
release asset I/O) and required separate Forgejo PATs to manage.
Replacing with a single CI_TOKEN keyed off a single PAT with the
union of scopes (write:repository + write:package).

- flutter.yml: APK attach step → CI_TOKEN
- release.yml: docker login → CI_TOKEN; APK fetch step → CI_TOKEN

No behavior change — same calls, single secret name. Operator needs
to set CI_TOKEN in repo settings (Actions → Secrets) with a PAT that
has write:repository + write:package; the prior REGISTRY_TOKEN /
RELEASE_TOKEN secrets can be removed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.forgejo/workflows/release.yml

@@ -60,7 +60,7 @@ jobs:
         if: steps.guard.outputs.ready == 'true'
         shell: bash
         run: |
-          echo "${{ secrets.REGISTRY_TOKEN }}" \
+          echo "${{ secrets.CI_TOKEN }}" \
             | docker login git.fabledsword.com -u "${{ github.actor }}" --password-stdin
 
       # In-app update flow (#397): on tag pushes only, fetch the APK
@@ -72,14 +72,14 @@ jobs:
         if: steps.guard.outputs.ready == 'true' && startsWith(github.ref, 'refs/tags/v')
         shell: bash
         env:
-          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          CI_TOKEN: ${{ secrets.CI_TOKEN }}
         run: |
           TAG="${GITHUB_REF#refs/tags/}"
           REPO="${GITHUB_REPOSITORY}"
           APK_URL="https://git.fabledsword.com/${REPO}/releases/download/${TAG}/minstrel-${TAG}.apk"
           echo "Polling ${APK_URL} (up to 15 min for flutter.yml to attach)..."
           for i in $(seq 1 30); do
-            if curl -fsSL -H "Authorization: token ${RELEASE_TOKEN}" \
+            if curl -fsSL -H "Authorization: token ${CI_TOKEN}" \
                 -o client/minstrel.apk "$APK_URL"; then
               echo "Got APK on attempt $i"
               echo "${TAG}" > client/minstrel.apk.version