chore(local): reuse FORGEJO_TOKEN for the auto-patch push (#125)

Follow-up to #124 (merged): the auto-patch pipeline required a separate write-scoped `REPO_RW_TOKEN` to push the branch. Reuse the existing `FORGEJO_TOKEN` instead.

- `propose-patches.R --open-pr` now pushes `auto/registry-patch-proposals` over HTTPS with `FORGEJO_TOKEN` (the same token used for the PR API); the read-only `origin` clone URL can't push, so it builds an authenticated URL explicitly.
- Drop `REPO_RW_TOKEN` from `.crow/auto-apply-patches.yaml` and the docs.

No new secret needed: the pipeline's secrets are now `PGPASS`, `REPO_RO_TOKEN`, and `FORGEJO_TOKEN` (all existing). `FORGEJO_TOKEN` must have repository write scope for the push to succeed.

105 tests pass; all pre-commit hooks pass.

Reviewed-on: #125

.crow/auto-apply-patches.yaml

@@ -6,8 +6,9 @@
 # human reviews the PR. Novel source diffs / unknown signatures are never
 # proposed. Global across platforms, so a single job -- no matrix.
 #
-# Needs a write token (REPO_RW_TOKEN) to push and FORGEJO_TOKEN to open the PR.
-# Register the `auto-apply-patches` cron in the crow UI, or run manually:
+# FORGEJO_TOKEN is used for both the branch push and opening the PR (no separate
+# write-scoped secret needed). Register the `auto-apply-patches` cron in the crow
+# UI, or run manually:
 #   woodpecker-cli pipeline create --var task=auto-apply-patches --branch=main 7
 variables:
   patch_limit:
@@ -34,8 +35,6 @@ steps:
         from_secret: PGPASS
       REPO_RO_TOKEN:
         from_secret: REPO_RO_TOKEN
-      REPO_RW_TOKEN:
-        from_secret: REPO_RW_TOKEN
       FORGEJO_TOKEN:
         from_secret: FORGEJO_TOKEN
       GIT_USER: devxy-bot