fix: use RELEASE_PAT for checkout and tag push

[Sathvik-Rao]

Summary

Add and document a RELEASE_PAT secret and use it for actions/checkout and for pushing tags/releases. GitHub suppresses workflow triggers for pushes made with GITHUB_TOKEN, so switching to a fine‑grained/classic PAT ensures the auto-generated vX.Y.Z tag push will trigger downstream workflows (e.g., tag-based Docker builds).

Type of change

• fix: ... — bug fix → patch bump (0.0.x)
• feat: ... — new feature → minor bump (0.x.0)
• feat!: ... / BREAKING CHANGE — breaking change → major bump (x.0.0)
• chore: / docs: / ci: / refactor: — no release created

PR title format

Your PR title becomes the commit message on merge and determines the version bump:

feat(resume): add cover letter section
fix: pdf export crash on empty work history
feat!: replace /generate endpoint with /build (breaking)
chore: update dev dependencies

Pattern: type(optional-scope): short description in lowercase

Checklist

• Tests added / updated under backend/tests/ for any changed backend/app/ code
• pytest passes locally (cd backend && pytest)
• PR title follows the format above

[github-actions]

Suggested tests for this PR

PR title: fix: use RELEASE_PAT for checkout and tag push

PR description:

Summary

Add and document a RELEASE_PAT secret and use it for actions/checkout and for pushing tags/releases. GitHub suppresses workflow triggers for pushes made with GITHUB_TOKEN, so switching to a fine‑grained/classic PAT ensures the auto-generated vX.Y.Z tag push will trigger downstream workflows (e.g., tag-based Docker builds).

Type of change

• fix: ... — bug fix → patch bump (0.0.x)
• feat: ... — new feature → minor bump (0.x.0)
• feat!: ... / BREAKING CHANGE — breaking change → major bump (x.0.0)
• chore: / docs: / ci: / refactor: — no release created

PR title format

Your PR title becomes the commit message on merge and determines the version bump:

feat(resume): add cover letter section
fix: pdf export crash on empty work history
feat!: replace /generate endpoint with /build (breaking)
chore: update dev dependencies

Pattern: type(optional-scope): short description in lowercase

Checklist

• Tests added / updated under backend/tests/ for any changed backend/app/ code
• pytest passes locally (cd backend && pytest)
• PR title follows the format above

No backend/app/**.py files changed — no test suggestions.