ci: explicitly wire secrets with from_secret in environment

.woodpecker.yml

@@ -2,21 +2,16 @@ when:
   branch: [main, high-performance]
   event: push
 
-secrets:
-  - secret: REGISTRY_HOSTPORT
-    name: REGISTRY_HOSTPORT
-  - secret: REGISTRY_USERNAME
-    name: REGISTRY_USERNAME
-  - secret: REGISTRY_PASSWORD
-    name: REGISTRY_PASSWORD
-
 steps:
   - name: build-and-push
     image: registry.nxtgauge.com/docker:28-cli
     environment:
-      REGISTRY_HOSTPORT: ${REGISTRY_HOSTPORT}
-      REGISTRY_USERNAME: ${REGISTRY_USERNAME}
-      REGISTRY_PASSWORD: ${REGISTRY_PASSWORD}
+      REGISTRY_HOSTPORT:
+        from_secret: REGISTRY_HOSTPORT
+      REGISTRY_USERNAME:
+        from_secret: REGISTRY_USERNAME
+      REGISTRY_PASSWORD:
+        from_secret: REGISTRY_PASSWORD
     commands:
       - echo "${REGISTRY_PASSWORD}" | docker login "${REGISTRY_HOSTPORT}" -u "${REGISTRY_USERNAME}" --password-stdin
       - docker build -t "${REGISTRY_HOSTPORT}/nxtgauge-ai-assistant" -f Dockerfile .