ci: pass Coolify token via env var to avoid pipe character shell issue

The | in Laravel Sanctum tokens gets interpreted as a shell pipe when
injected inline. Using env vars ensures proper quoting.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -54,9 +54,12 @@ jobs:
             --push .
 
       - name: Trigger Coolify deploy
+        env:
+          COOLIFY_TOKEN: ${{ secrets.COOLIFY_TOKEN }}
+          COOLIFY_WEBHOOK: ${{ vars.COOLIFY_WEBHOOK }}
         run: |
-          curl -s -X GET "${{ vars.COOLIFY_WEBHOOK }}" \
-            -H "Authorization: Bearer ${{ secrets.COOLIFY_TOKEN }}"
+          curl -s -X GET "${COOLIFY_WEBHOOK}" \
+            -H "Authorization: Bearer ${COOLIFY_TOKEN}"
 
   e2e:
     if: false  # E2E tests need rewrite: auth moved from local login to OIDC (Logto). Tests still expect username/password flow.