CI: authenticate to GHCR with a PAT so images are published again

The built-in GITHUB_TOKEN has no write access to these packages, so every run
since 1773a0c ended in permission_denied: write_package. The build itself
succeeded, so the workflow looked healthy while the images silently stopped
being rebuilt — they had to be built and pushed by hand for weeks.

Uses a PAT with write:packages. Granting the packages write access to this
repo would let GITHUB_TOKEN come back and the secret go away.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KZntQUfw463NW4ftgSjWw5

.github/workflows/publish.yml

@@ -35,12 +35,17 @@ jobs:
 
       - uses: docker/setup-buildx-action@v3
 
+      # The built-in GITHUB_TOKEN has no write access to these packages, so every
+      # push since 1773a0c failed with "denied: permission_denied: write_package"
+      # and the images silently stopped being rebuilt. Use a PAT with
+      # write:packages until the packages grant this repo write access, at which
+      # point GITHUB_TOKEN can come back.
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.GHCR_PAT }}
 
       - name: Build and push backend image
         uses: docker/build-push-action@v5