CI: use WATCHTOWER_HTTP_API_TOKEN secret name as set on the repo

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -67,5 +67,5 @@ jobs:
       - name: Trigger Watchtower update
         if: success()
         run: |
-          curl -sf -H "Authorization: Bearer ${{ secrets.WATCHTOWER_TOKEN }}" \
+          curl -sf -H "Authorization: Bearer ${{ secrets.WATCHTOWER_HTTP_API_TOKEN }}" \
             http://watchtower:8080/v1/update

AGENTS.md

@@ -93,7 +93,7 @@ make typecheck      # mypy
 - Deployment is CI-driven: pushing a `v*` tag makes Gitea Actions test, build, and push
   `desklock-gateway:{latest,tag}` to the registry and trigger Watchtower
   (`.gitea/workflows/build.yml`; needs `REGISTRY_USER`/`REGISTRY_PASSWORD`/
-  `WATCHTOWER_TOKEN` secrets). Plain pushes to `main` run lint + tests only. The
+  `WATCHTOWER_HTTP_API_TOKEN` secrets). Plain pushes to `main` run lint + tests only. The
   gateway deploys as part of the **`tatlock-ui` Portainer stack** —
   `system-admin-toj/containers/stacks/tatlock-ui.yml` (registered in `CONTAINERS.md`,
   port 8600). Stack updates go through the Portainer API on :8001 (JWT auth; recipe in

docs/architecture.md

@@ -257,7 +257,7 @@ Gitea Actions (`.gitea/workflows/build.yml`), following the tatlock/tatlock-ui p
   Gitea registry, create a release, and trigger Watchtower to roll the running
   container.
 - Required repo/org secrets: `REGISTRY_USER`, `REGISTRY_PASSWORD`,
-  `WATCHTOWER_TOKEN` (same trio tatlock uses).
+  `WATCHTOWER_HTTP_API_TOKEN` (same trio tatlock uses).
 - The gateway is a service in the **`tatlock-ui` Portainer stack**
   (`system-admin-toj/containers/stacks/tatlock-ui.yml`, registered in
   `CONTAINERS.md`): it shares `docker-dataplane` with Speaches (service-name URL