fix(ci): hardcode PORTAINER_URL to http://portainer:9000

Drop the secret indirection and just use the service name directly.
All services share the portainer_default Docker network so 'portainer'
resolves to Portainer from any container in that network.

.gitea/workflows/ci-cd.yaml

@@ -65,14 +65,14 @@ jobs:
       - name: Redeploy stack on Portainer
         if: github.event_name == 'workflow_dispatch' && inputs.deploy == true
         env:
-          PORTAINER_URL: ${{ secrets.PORTAINER_URL }}
           PORTAINER_TOKEN: ${{ secrets.PORTAINER_TOKEN }}
           PORTAINER_ENDPOINT_ID: ${{ secrets.PORTAINER_ENDPOINT_ID }}
           PORTAINER_STACK_ID: ${{ secrets.PORTAINER_STACK_ID }}
         run: |
           # Portainer, Gitea and the runners all share the `portainer_default`
           # Docker network on the NAS, so the service name "portainer" resolves
-          # directly from the job container. No need for IP auto-discovery.
+          # directly from the job container on port 9000.
+          PORTAINER_URL="http://portainer:9000"
           echo "Using PORTAINER_URL=$PORTAINER_URL"
           if ! curl -sS -o /dev/null -w '%{http_code}' --max-time 5 \
               "${PORTAINER_URL}/api/status" | grep -q '^200$'; then