fix: use GHCR_PAT for image push (org policy blocks GITHUB_TOKEN write)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Zingzy

.github/workflows/deploy.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.GHCR_PAT }}
 
       - name: Extract metadata
         id: meta
@@ -71,7 +71,7 @@ jobs:
           script: |
             set -e
             cd /opt/spoo
-            echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+            echo "${{ secrets.GHCR_PAT }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
             docker compose -f docker-compose.prod.yml pull
             docker compose -f docker-compose.prod.yml up -d --remove-orphans
             docker image prune -f