ci: install docker CLI in job container + shared DOCKER_CONFIG

The job runs in node:20-bookworm which ships no docker binary
(run 21 died with 'Unable to locate executable file: docker').
Install static docker client + buildx, and fail fast with an
actionable error if the runner has not mounted the docker socket.

.gitea/workflows/build-and-push.yaml

@@ -20,6 +20,9 @@ env:
   REGISTRY: src.panahifar.ir
   BACKEND_IMAGE: ahp/pargar-backend
   FRONTEND_IMAGE: ahp/pargar-frontend
+  # Single credential location shared by login + build steps (the job runs
+  # in a container whose HOME can differ between steps).
+  DOCKER_CONFIG: /tmp/.docker
 
 jobs:
   build:
@@ -32,6 +35,22 @@ jobs:
         id: meta
         run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
+      # The job container (node:20-bookworm) ships no docker CLI, and builds
+      # run against the runner host's daemon (docker-outside-of-docker), so
+      # the socket must be mounted by the runner config.
+      - name: Set up Docker CLI (not shipped in job container)
+        run: |
+          set -eu
+          if [ ! -S /var/run/docker.sock ]; then
+            echo "::error::/var/run/docker.sock is not mounted in the job container - add 'options: -v /var/run/docker.sock:/var/run/docker.sock' and 'valid_volumes: [/var/run/docker.sock]' under 'container:' in the act_runner config.yaml, then restart the runner."
+            exit 1
+          fi
+          curl -fsSL "https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz" | tar xz --strip-components=1 -C /usr/local/bin docker/docker
+          mkdir -p /root/.docker/cli-plugins
+          curl -fsSL "https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64" -o /root/.docker/cli-plugins/docker-buildx
+          chmod +x /root/.docker/cli-plugins/docker-buildx
+          docker version
+
       - name: Login to Gitea container registry
         uses: docker/login-action@v3
         with: