docs: define every Actions variable/secret in step 6

REGISTRY_USER/OWNER, REGISTRY_TOKEN, DEPLOY_HOST/USER/SSH_KEY each spelled
out with what to store and why, plus deploy-keypair generation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -163,9 +163,26 @@ host using its Docker, not in a socket-less container). See
 
 ### 6. Wire the jb-website repo
 In the `jb-website` repo settings on Forgejo (`Settings → Actions`):
-- **Variables:** `REGISTRY_OWNER` = your lowercase owner.
+
-- **Secrets:** `REGISTRY_USER`, `REGISTRY_TOKEN` (the PAT), `DEPLOY_HOST`
+**Variable:**
-  (`45.32.242.27`), `DEPLOY_USER`, `DEPLOY_SSH_KEY`.
+- `REGISTRY_OWNER` — your **lowercase** Forgejo username/org; the image namespace
+  (`git.joshbairstow.com/<owner>/jb-website`).
+
+**Secrets:**
+- `REGISTRY_USER` — your Forgejo login username (the account that owns the PAT);
+  the username for `docker login`. Usually equals `REGISTRY_OWNER`.
+- `REGISTRY_TOKEN` — the PAT with `write:package` scope; the `docker login` password.
+- `DEPLOY_HOST` — `45.32.242.27`.
+- `DEPLOY_USER` — the VPS account the runner SSHes in as: `root` to start, or a
+  dedicated `deploy` user (in the `docker` group) for least privilege.
+- `DEPLOY_SSH_KEY` — the **private** key of a *dedicated deploy keypair* (full
+  file incl. `BEGIN/END` lines; paste multi-line — OpenSSH needs the newlines).
+  NOT your personal key. Generate + install its public half on the VPS:
+  ```sh
+  ssh-keygen -t ed25519 -f ~/.ssh/jb-deploy -C forgejo-ci-deploy -N ""
+  ssh-copy-id -i ~/.ssh/jb-deploy.pub <DEPLOY_USER>@45.32.242.27
+  cat ~/.ssh/jb-deploy        # <- paste this into DEPLOY_SSH_KEY
+  ```
 
 On the **VPS**, prepare the deploy target:
 ```sh