Wire JWT_SECRET/POSTGRES_PASSWORD through Gitea Actions secrets

The job checks out into the runner's own workspace, not
/opt/ruvdstests where DEPLOY.md has the human create a .env file — so
docker compose here had no .env to read JWT_SECRET from and failed
outright. POSTGRES_PASSWORD would have silently fallen back to the
compose file's devpassword default instead of erroring, which on
Deploy would have broken auth against the already-initialized pgdata
volume.

.gitea/workflows/ci-cd.yml

@@ -10,8 +10,19 @@ on:
 # checkout path — otherwise `docker compose` would derive the project name
 # from the checkout directory, potentially spinning up a second stack and
 # losing the `pgdata` volume instead of updating the running one.
+#
+# JWT_SECRET/POSTGRES_PASSWORD come from Gitea's own Actions secrets store
+# rather than the `.env` file DEPLOY.md has the human create in
+# `/opt/ruvdstests` — the job checks out into the runner's own workspace, not
+# that directory, so there's no `.env` for `docker compose` to read here.
+# Must match the values already in that `.env` file: on `Deploy` this
+# `docker compose up -d` targets the same running project (via
+# COMPOSE_PROJECT_NAME above), and a different POSTGRES_PASSWORD than what
+# the live `pgdata` volume was initialized with breaks the DB connection.
 env:
   COMPOSE_PROJECT_NAME: ruvdstests
+  JWT_SECRET: ${{ secrets.JWT_SECRET }}
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
 
 jobs:
   build-test-deploy: