Use bare tokens: PAT_FOR_GITHUB replaces CREDENTIALS_FOR_GITHUB

The sync workflow reads secrets.PAT_FOR_GITHUB as clear text and
parse_github_token and parse_gitea_token only check that the value is not
empty. No secret is JSON any more; the wiki publisher follows. Update the
tests, the guides, the README, PP-001 UC candidate 2 and the wiki pages with
their Danish and Bahasa Malaysia translations.

Task: MIL-002#5

guides/credentials.md

@@ -6,8 +6,8 @@ leaves.
 
 | Secret | Content | Used for |
 | --- | --- | --- |
-| `TOKEN_FOR_GITEA` | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Reading the repository (description, topics) and its push mirrors |
-| `CREDENTIALS_FOR_GITHUB` | JSON object with a non-empty `GITHUB_PAT` | Changing the description and topics of the GitHub mirror |
+| `TOKEN_FOR_GITEA` | The Gitea token, nothing else | Reading the repository (description, topics) and its push mirrors |
+| `PAT_FOR_GITHUB` | The GitHub token, nothing else | Changing the description and topics of the GitHub mirror |
 
 ## Minimum permissions
 
@@ -34,11 +34,9 @@ Calls made: `GET /repos/{owner}/{repo}` and `GET /repos/{owner}/{repo}/push_mirr
 Calls made: `GET /repos/{owner}/{repo}`, `PATCH /repos/{owner}/{repo}` (description)
 and `PUT /repos/{owner}/{repo}/topics`.
 
-Format of `CREDENTIALS_FOR_GITHUB`:
-
-```json
-{"GITHUB_PAT": "<token>"}
-```
+Format of `PAT_FOR_GITHUB`: only the token string (for example
+`github_pat_...`), as clear text. The workflow only checks that it is not empty;
+GitHub rejects a wrong value (HTTP 401).
 
 ## What the workflow checks before it changes anything
 
@@ -64,7 +62,7 @@ when that secret exists and otherwise reuses `TOKEN_FOR_GITEA`.
 
 | Secret | Content | Used for |
 | --- | --- | --- |
-| `TOKEN_FOR_GITEA_WIKI` (optional) | A bare token, a JSON string, or JSON with `GITEA_TOKEN` | Writing the wiki pages of this repository |
+| `TOKEN_FOR_GITEA_WIKI` (optional) | The Gitea token, nothing else | Writing the wiki pages of this repository |
 
 - The token that is used needs scope `write:repository`, and its user needs
   write access to this repository. Gitea has no wiki-only scope.

guides/onboarding.md

@@ -27,7 +27,7 @@ Until delivery is verified, onboard a repository by copying the workflow (below)
 3. **Add the two secrets** in the repository (or organization) settings,
    using the scopes in [credentials.md](credentials.md):
    - `TOKEN_FOR_GITEA`
-   - `CREDENTIALS_FOR_GITHUB` (JSON with `GITHUB_PAT`)
+   - `PAT_FOR_GITHUB` (the GitHub token only)
 4. **Deliver the workflow:**
    - *If scoped workflows apply to the repository:* nothing to copy.
    - *Otherwise:* copy `.gitea/scoped_workflows/sync-github-metadata.yml`

guides/troubleshooting.md

@@ -22,12 +22,8 @@ never starts, or stops before the step) is a **runner** problem.
 
 | Message (start) | Category | Cause and fix |
 | --- | --- | --- |
-| `CREDENTIALS_FOR_GITHUB is missing or empty.` | configuration | Add the secret |
-| `CREDENTIALS_FOR_GITHUB must contain valid JSON.` | configuration | The value must be JSON such as `{"GITHUB_PAT": "..."}` |
-| `CREDENTIALS_FOR_GITHUB must be a JSON object.` | configuration | Use an object, not a list or string |
-| `CREDENTIALS_FOR_GITHUB must contain a non-empty GITHUB_PAT.` | configuration | Add the `GITHUB_PAT` key with a token |
+| `PAT_FOR_GITHUB is missing or empty.` | configuration | Add the secret |
 | `TOKEN_FOR_GITEA is missing or empty.` | configuration | Add the secret |
-| `TOKEN_FOR_GITEA must contain a non-empty GITEA_TOKEN.` | configuration | The JSON form needs a `GITEA_TOKEN` key |
 | `Could not determine the Gitea source repository.` | configuration | The run has no repository name; report as a defect |
 | `Expected at most one GitHub push mirror ... found N` | configuration | Keep one GitHub push mirror |
 | `No token for the wiki: set TOKEN_FOR_GITEA_WIKI, or TOKEN_FOR_GITEA.` | configuration | Wiki publishing only: add one of the secrets (see [credentials.md](credentials.md)) |
@@ -36,7 +32,7 @@ never starts, or stops before the step) is a **runner** problem.
 | `The wiki source directory ... has no Markdown pages` | configuration | Wiki publishing only: `wiki/` is empty or missing; nothing was changed |
 | `Could not determine the GitHub owner and repository ...` | configuration | The mirror address must look like `https://github.com/<owner>/<repo>.git` |
 | `Gitea API request failed with HTTP 401` | credentials | Create a new Gitea token and update `TOKEN_FOR_GITEA` |
-| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `CREDENTIALS_FOR_GITHUB` |
+| `GitHub API request failed with HTTP 401` | credentials | Create a new GitHub token and update `PAT_FOR_GITHUB`; the value must be the token only (no name, quotes or JSON) |
 | `... HTTP 403 ...` (Gitea) | permissions | Token needs `read:repository`, and its user needs administrator access to the repository |
 | `... HTTP 403 ...` (GitHub) | permissions | Token needs Administration read and write on the mirror repository |
 | `The GitHub token cannot administer <repo>` | permissions | Same as above; the token can read the repository but not edit it |