feat: registry credentials from k8s Secret via env vars

- main.go: REGISTRY_USERNAME / REGISTRY_TOKEN env vars override config file
- manifests/hub.yaml: reference Secret/gitea-creds, remove plaintext creds from ConfigMap

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

manifests/hub.yaml

@@ -84,8 +84,8 @@ data:
       resend_api_key: "re_XZZenCJs_LyJnU12jZWfEn9rK85Gc83DK"
     registry:
       image: "gitea.dooplex.hu/admin/felhom-controller"
-      username: "admin"
-      token: "e93ef87f90cc13a476964ee965bfe2e75d945a33"
+      # username + token injected via REGISTRY_USERNAME / REGISTRY_TOKEN env vars
+      # from Secret/gitea-creds (see Deployment below)
       check_interval: "6h"
       template_interval: "1h"
     server:
@@ -124,6 +124,16 @@ spec:
           env:
             - name: TZ
               value: "Europe/Budapest"
+            - name: REGISTRY_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-creds
+                  key: username
+            - name: REGISTRY_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-creds
+                  key: password
           resources:
             requests:
               memory: "64Mi"