ci: authenticate registry with REGISTRY_TOKEN secret

Use an explicit Gitea token (write:package scope) instead of the
built-in job token for docker login.

.gitea/workflows/build-and-push.yaml

@@ -4,8 +4,9 @@ name: build-and-push
 # Gitea container registry. Argo CD then rolls them out via
 # deploy/helm/pargar (values-apollo.yaml pins the matching image tags).
 #
-# Requires a registered Gitea Actions runner and `permissions.packages: write`
-# so the built-in job token (secrets.GITEA_TOKEN) can push to the registry.
+# Requires a registered Gitea Actions runner, a `REGISTRY_TOKEN` secret
+# (Gitea access token with write:package scope) so docker login can push to
+# the registry.
 
 on:
   push:
@@ -20,6 +21,9 @@ env:
   REGISTRY: src.panahifar.ir
   BACKEND_IMAGE: ahp/pargar-backend
   FRONTEND_IMAGE: ahp/pargar-frontend
+  # Single credential location shared by login + build steps (the job runs
+  # in a container whose HOME can differ between steps).
+  DOCKER_CONFIG: /tmp/.docker
 
 jobs:
   build:
@@ -32,12 +36,28 @@ jobs:
         id: meta
         run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
+      # The job container (node:20-bookworm) ships no docker CLI, and builds
+      # run against the runner host's daemon (docker-outside-of-docker), so
+      # the socket must be mounted by the runner config.
+      - name: Set up Docker CLI (not shipped in job container)
+        run: |
+          set -eu
+          if [ ! -S /var/run/docker.sock ]; then
+            echo "::error::/var/run/docker.sock is not mounted in the job container - add 'options: -v /var/run/docker.sock:/var/run/docker.sock' and 'valid_volumes: [/var/run/docker.sock]' under 'container:' in the act_runner config.yaml, then restart the runner."
+            exit 1
+          fi
+          curl -fsSL "https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz" | tar xz --strip-components=1 -C /usr/local/bin docker/docker
+          mkdir -p /root/.docker/cli-plugins
+          curl -fsSL "https://github.com/docker/buildx/releases/download/v0.19.3/buildx-v0.19.3.linux-amd64" -o /root/.docker/cli-plugins/docker-buildx
+          chmod +x /root/.docker/cli-plugins/docker-buildx
+          docker version
+
       - name: Login to Gitea container registry
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
-          password: ${{ secrets.GITEA_TOKEN }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
 
       - name: Build and push backend
         uses: docker/build-push-action@v6