feat: use Trusted Publisher Management instead of API Token

.github/workflows/publish.yml

@@ -1,4 +1,4 @@
-name: CI
+name: Publish to PyPI
 
 on:
   push:
@@ -18,6 +18,11 @@ jobs:
   publish-pypi:
     name: Publish to PyPI
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/pdfuck
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -26,6 +31,3 @@ jobs:
       - run: uv build
       - name: Publish a Python distribution to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}