Pass explicit token to checkout for private theme submodule

The default per-job Actions token only covers the triggering repo; the
theme submodule lives in a separate private repo (hmk/pelican-latex), so
cloning it needs a token with read access to both. Add CHECKOUT_TOKEN
as a repo secret (a Gitea access token with repo read scope) for this
to work.

.gitea/workflows/build-deploy.yml

@@ -19,6 +19,10 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: recursive
+          # Default job token only covers this repo; the theme submodule
+          # (hmk/pelican-latex) is a separate private repo, so a token with
+          # read access to both is needed here.
+          token: ${{ secrets.CHECKOUT_TOKEN }}
 
       - name: Install Python dependencies
         run: pip install --no-cache-dir -r requirements.txt