declare packages: write so the registry login works

The first build pushed nothing: `docker login git.ffaerber.duckdns.org` came
back "unauthorized". Gitea scopes the automatic Actions token from the job's
permissions block, and without one it has no package write -- so the build
succeeded and the push failed on auth, which reads like a credential problem
rather than a missing declaration.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYFnHida4AdiNDek2pzgXx

.gitea/workflows/docker.yml

@@ -21,6 +21,13 @@ on:
 env:
   HOMELAB_API_URL: https://t4tgw-api.ffaerber.duckdns.org
 
+# Gitea derives the automatic token's scopes from this block; without it the
+# token cannot write packages and `docker login` to this instance's registry
+# fails with a bare "unauthorized".
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build:
     runs-on: ci-runner