fix: validate registry credentials before docker login

Add credential validation step to catch missing secrets early with clear error message.
Use direct secret injection (not env vars) for better security.
Isolate docker config to /tmp/docker-config.

.gitea/workflows/ci.yaml

@@ -54,13 +54,21 @@ jobs:
           SHORT_SHA=$(git rev-parse --short HEAD)
           echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
 
+      - name: Validate registry credentials
+        run: |
+          if [ -z "${{ secrets.FORGEJO_REGISTRY_USER }}" ] || [ -z "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" ]; then
+            echo "❌ ERROR: Registry secrets not configured"
+            echo "Set FORGEJO_REGISTRY_USER and FORGEJO_REGISTRY_TOKEN in repo settings"
+            exit 1
+          fi
+          echo "✓ Registry credentials configured"
+
       - name: Registry login
         run: |
-          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
+          echo "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" | docker login "${{ env.REGISTRY }}" \
-            --username "${REGISTRY_USER}" --password-stdin
+            --username "${{ secrets.FORGEJO_REGISTRY_USER }}" --password-stdin
         env:
-          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
+          DOCKER_CONFIG: /tmp/docker-config
-          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
 
       - name: Build Docker image
         run: |