[AZ-203] Parameterize registry host via REGISTRY_HOST secret

Pipeline reads $REGISTRY_HOST from the Woodpecker global secret
'registry_host' instead of hardcoding 'localhost:5000'. The full
host:port lives in the secret, so Harbor migration (AZ-205) becomes
one secret edit rather than editing every submodule pipeline.

Made-with: Cursor

.woodpecker/build-arm.yml

@@ -8,9 +8,12 @@ labels:
 steps:
   - name: build-push
     image: docker
+    environment:
+      REGISTRY_HOST:
+        from_secret: registry_host
     commands:
       - if [ "$CI_COMMIT_BRANCH" = "main" ]; then export TAG=arm; else export TAG=${CI_COMMIT_BRANCH}-arm; fi
-      - docker build -f Dockerfile -t localhost:5000/ui:$TAG .
-      - docker push localhost:5000/ui:$TAG
+      - docker build -f Dockerfile -t $REGISTRY_HOST/ui:$TAG .
+      - docker push $REGISTRY_HOST/ui:$TAG
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock