build-push: drop the empty ${{ }} that silenced the registry login

Forgejo evaluates ${{ }} expressions inside a step's `run:` script, comments
included. An EMPTY expression is a parse error, and the runner's response is to
drop the step -- no log line, no error, no failed status. The login step simply
never ran, so every subsequent `docker push` went out anonymous.

The registry then answers `unauthorized: reqPackageAccess` (or, depending on
the client path, `no basic auth credentials`), which reads exactly like a
revoked token or a missing scope. It is neither. Both are downstream of a
comment.

Isolated on one branch, one variable, back to back:

  * empty expression present -> both legs fail, no `Login Succeeded` in the log
  * empty expression removed -> both legs pass, `Login Succeeded` present,
    sha-df409f88b3fd published for backend and frontend

Nothing was wrong with the credential. The token, its scope and whether it sat
at repo or organization level were all ruled out first: pushes to
jinemi/thermograph/* succeed by hand from vps1 and from the runner host, with
matching and mismatched usernames, and the run log shows REGISTRY_TOKEN
arriving in the job environment.

Do not write a bare ${{ }} in a run block, in a comment or otherwise.

.forgejo/workflows/build-push.yml

@@ -131,7 +131,7 @@ jobs:
           # credential that was in fact valid. Strip first, echo never.
           #
           # The token also goes through the ENVIRONMENT rather than being
-          # interpolated into the script text. `${{ }}` is substituted before bash
+          # interpolated into the script text. An expression is substituted before bash
           # parses the line, so a value containing a quote or newline would change
           # the shape of the command itself rather than just its arguments.
           tok=$(printf '%s' "$REGISTRY_TOKEN" | tr -d ' \t\r\n')