Reapply "ci: use GitHub Container Registry"

This reverts commit caf586f1ad.

deploy.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # ANOUMA — server-side deployment script.
 #
-# This is NOT a manual update tool. It is invoked exclusively by Gitea
+# This is NOT a manual update tool. It is invoked exclusively by GitHub
 # Actions over SSH as the restricted `anouma-deploy` user (see setup.sh,
 # which installs a forced-command SSH key that can only ever run this
 # script). The production server never builds an image — it only ever
@@ -106,7 +106,7 @@ backup_database() {
 
 registry_login() {
   if [ -n "${REGISTRY_USERNAME:-}" ] && [ -n "${REGISTRY_PASSWORD:-}" ]; then
-    echo "$REGISTRY_PASSWORD" | docker login "${REGISTRY:-git.maro.run}" -u "$REGISTRY_USERNAME" --password-stdin >/dev/null 2>&1 \
+    echo "$REGISTRY_PASSWORD" | docker login "${REGISTRY:-ghcr.io}" -u "$REGISTRY_USERNAME" --password-stdin >/dev/null 2>&1 \
       && log_success "Registry login OK." \
       || fail "Registry login failed — check REGISTRY_USERNAME/REGISTRY_PASSWORD in .env."
   fi
@@ -116,7 +116,7 @@ registry_login() {
 # the rest of this script (and `docker compose`, via env_file) picks it up.
 set_image_version() {
   local version="$1"
-  env_set ANOUMA_IMAGE "${REGISTRY:-git.maro.run}/${REGISTRY_REPO:-maro/anouma}:${version}"
+  env_set ANOUMA_IMAGE "${REGISTRY:-ghcr.io}/${REGISTRY_REPO:-whitehai11/anouma}:${version}"
   set -a; source .env; set +a
 }