Add HARBOR_USER/HARBOR_TOKEN from Woodpecker secrets and a docker login step before the existing build/push, so pipelines can push to the new TLS-authenticated Harbor registry.