Fix CI for the user-scoped runners

- ci.yml: connect to the test MariaDB as root so Django creates the test
  database itself (no client install/grant step), and drop actions/cache
  (cache: pip/npm): Gitea's cache service hangs the job on restore/save.
- publish.yml: prefer the REGISTRY_USER/REGISTRY_TOKEN secrets (as on other
  repos) and fall back to the automatic Actions token.
- AGENTS.md: note the CI layout, the runner labels and the cache caveat.

.gitea/workflows/ci.yml

@@ -30,24 +30,25 @@ jobs:
           MARIADB_USER: j621
           MARIADB_PASSWORD: j621
         options: >-
-          --health-cmd "healthcheck.sh --connect --innodb_initialized"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 20
+          --health-cmd="healthcheck.sh --connect --innodb_initialized"
+          --health-interval=5s
+          --health-timeout=5s
+          --health-retries=12
       redis:
         image: redis:7-alpine
         options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 20
+          --health-cmd="redis-cli ping"
+          --health-interval=5s
+          --health-timeout=5s
+          --health-retries=12
     env:
+      # Connect as root so Django can create the test database itself;
+      # everything else mirrors the development defaults.
       DB_HOST: mariadb
       DB_PORT: "3306"
       DB_NAME: j621
-      DB_USER: j621
-      DB_PASSWORD: j621
-      DB_ROOT_PASSWORD: root
+      DB_USER: root
+      DB_PASSWORD: root
       REDIS_URL: redis://redis:6379/1
     steps:
       - uses: actions/checkout@v4
@@ -55,27 +56,10 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.14"
-          cache: pip
-          cache-dependency-path: backend/requirements.txt
 
       - name: Install backend dependencies
         run: pip install -r backend/requirements.txt
 
-      - name: Install a MariaDB client
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends default-mysql-client
-
-      - name: Grant the test database rights
-        run: |
-          for i in $(seq 1 30); do
-            mysql -h "$DB_HOST" -P "$DB_PORT" -u root -p"$DB_ROOT_PASSWORD" \
-              -e "SELECT 1" >/dev/null 2>&1 && break
-            sleep 2
-          done
-          mysql -h "$DB_HOST" -P "$DB_PORT" -u root -p"$DB_ROOT_PASSWORD" \
-            -e "GRANT ALL ON \`test_j621\`.* TO 'j621'@'%'; FLUSH PRIVILEGES;"
-
       - name: Django system checks
         working-directory: backend
         run: python manage.py check
@@ -98,8 +82,6 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "22"
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
 
       - name: Install frontend dependencies
         working-directory: frontend