fix: use docker login directly for Gitea basic auth, disable provenance

.gitea/workflows/docker.yml

@@ -43,13 +43,11 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      # docker/login-action uses OAuth token exchange which Gitea doesn't support.
+      # Use docker login directly for basic auth.
       - name: Log in to registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
+        run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${{ env.REGISTRY }} -u ${{ secrets.REGISTRY_USER }} --password-stdin
 
       - name: Build and push — standard
         uses: docker/build-push-action@v6
@@ -62,6 +60,7 @@ jobs:
           cache-from: type=gha,scope=standard
           cache-to: type=gha,mode=max,scope=standard
           platforms: linux/amd64,linux/arm64
+          provenance: false
 
       - name: Build and push — bundled (postgres included)
         uses: docker/build-push-action@v6
@@ -74,3 +73,4 @@ jobs:
           cache-from: type=gha,scope=bundled
           cache-to: type=gha,mode=max,scope=bundled
           platforms: linux/amd64,linux/arm64
+          provenance: false