ci(lotus): read the npm publish token from NPM_PUBLISH_TOKEN

Gitea reserves secret names beginning with GITEA_, so the
`GITEA_NPM_TOKEN` this workflow has referenced since the fork's first
commit could never be created — which is why CI publishing never worked
and the June release was pushed by hand. Rename to NPM_PUBLISH_TOKEN
(org secret, write:package).

Refs #22

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

.gitea/workflows/ci.yml

@@ -183,6 +183,9 @@ jobs:
       # last upstream-parity publish.
       - name: Publish
         working-directory: embedded/web
+        # Secret names starting with GITEA_ are reserved and can't be created, so
+        # the original `GITEA_NPM_TOKEN` never existed (every CI publish since the
+        # fork's first commit hit ENEEDAUTH). Org secret, write:package scope.
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
         run: npm publish --access public --tag lotus