ci: wire deploy to PyPI trusted publishing via pypi environment

The deploy job was trying to publish with password=${{ secrets.PYPI_API_TOKEN }},
but the repo has no API token secret — only the pypi GitHub environment,
which is the convention for OIDC trusted publishing. The job lacked
environment: pypi and id-token: write, so OIDC token retrieval failed.
Removed the password input so the action uses trusted publishing.

Author: cainky

.github/workflows/ci.yml

@@ -124,6 +124,10 @@ jobs:
     if: github.ref == 'refs/heads/main' && github.event_name == 'push'
     runs-on: ubuntu-latest
     needs: [test, security, integration]
+    environment: pypi
+    permissions:
+      contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -143,8 +147,6 @@ jobs:
 
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2