fix(docs): capture localhost tarball blocker in Docker

docs/devops/GITEA_NPM_REGISTRY_MIGRATION.md

@@ -176,7 +176,7 @@ At the time of writing:
 
 - host-side registry usage is validated
 - FlowMonk host-side pilot migration is validated
-- Docker-side local-registry validation is still blocked
+- Docker-side local-registry validation is still blocked after auth succeeds because embedded tarball URLs still resolve to `localhost:3300` inside the build container
 
 That blocker must be resolved before we can claim full local E2E completion.
 
@@ -191,6 +191,7 @@ The local rehearsal on this Mac has proven enough to validate the **host-side**
 - Docker / BuildKit package installs from the local Homebrew Gitea instance are still not green
 - the Homebrew Gitea `ROOT_URL` / package tarball URL behavior is still fragile across host and Docker boundaries
 - Docker-side package installs currently need a real Gitea package token even though host-side installs only need non-empty `GITEA_NPM_TOKEN` env resolution for `.npmrc`
+- even with a real token, the current FlowMonk backend Docker build still fails once package metadata redirects tarball fetches to `http://localhost:3300/...` inside the container
 - local Gitea Actions has not yet been validated end-to-end for the package build → publish → consumer flow
 - the FlowMonk pilot is currently validated only for backend/web host-side consumption; Docker is still blocked and mobile remains outside the registry-backed pilot slice
 - not all `@bytelyst/*` packages have been revalidated under the local Gitea registry with a fresh consumer install after the `pnpm pack` publish flow changes