Fix CI: use docker-host runner for image builds
The plain `docker` runner label doesn't expose the host Docker socket, so
`docker build` fails with "Cannot connect to the Docker daemon". Split the
pipeline: test job stays on `docker` (slim uv image, manual git clone),
image job moves to `docker-host` with node:22-bookworm + apt-installed
docker.io. Matches the pattern already working in brad/vikunja-brad.
Also renames registry auth secrets to REGISTRY_USER / REGISTRY_TOKEN to
match the rest of Brad's Forgejo setup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>