Rename CI credentials to org-wide names, demote non-secrets to variables

Mirrors the ProxmoxVE change so both repos read the same org-level
secrets and rotation is one edit rather than two:

  vars.APP_ID / secrets.APP_PRIVATE_KEY   -> GHAPP_HEADERS_*
  secrets.APP_{ID,KEY}_APPROVE_AND_MERGE  -> GHAPP_MERGEBOT_*
  vars.PUSH_MAIN_APP_ID / secrets.PUSH_MAIN_APP_SECRET -> GHAPP_SYNC_*
  secrets.POCKETBASE_URL/_COLLECTION      -> vars.*
  secrets.FRONTEND_URL                    -> vars.FRONTEND_URL
  secrets.REVALIDATE_SECRET               -> secrets.FRONTEND_INGEST_SECRET
  secrets.GH_MERGE_PAT                    -> secrets.GH_CROSS_REPO_TOKEN

Discord guild and channel ids are snowflakes, not credentials, so they
move to variables too.

auto-update-app-headers keeps its client-id input rather than being
normalised to app-id like the ProxmoxVE copy: that step is
continue-on-error with a fallback to github.token, so getting the input
name wrong would degrade it silently instead of failing. Worth settling
separately against the app's actual id.

Author: MickLesk