- GiteaClient.change_admin_password: add required login_name and
source_id fields (was returning 422 Unprocessable Entity)
- provision_woodpecker: read WP API token from woodpecker DB hash
instead of using Gitea token (Woodpecker uses Gitea OAuth, its
API requires the user hash not a Gitea API token)
- Pin fhirworx/rustfs and fhirworx/postgresql to :latest — these
aren't built by the pipeline so COMMIT_SHA tag doesn't exist