ci: use GHCR_TOKEN org secret for droplet docker login

GITHUB_TOKEN only works on the Actions runner, not external machines.
GHCR_TOKEN is a PAT with read:packages scope that the droplet can use
to pull from ghcr.io/pmlabs-org.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: PM-Labs

.github/workflows/ci.yml

@@ -82,9 +82,11 @@ jobs:
       - name: Deploy to droplet
         run: |
           ssh ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }} \
-            "cd /opt/pmin-mcpinfrastructure && \
-             docker compose pull toggl && \
-             docker compose up -d --force-recreate toggl"
+            "echo '${{ secrets.GHCR_TOKEN }}' | docker login ghcr.io -u '${{ github.actor }}' --password-stdin \
+            && cd /opt/pmin-mcpinfrastructure \
+            && docker compose pull toggl \
+            && docker compose up -d --force-recreate toggl \
+            && docker logout ghcr.io"
 
       - name: Health check
         run: |