Make Docker build/push resilient to missing secrets for local act runs

- Add credential-check step so docker login gracefully skips when
  GITEA_TOKEN is unavailable (e.g. local 'act' runs)
- Build step always runs locally; push only when credentials exist
- Add .actrc for convenience runner image mapping

.actrc

@@ -0,0 +1,2 @@
+-P ubuntu-latest=catthehacker/ubuntu:act-latest
+--artifact-server-path=/tmp/act-artifacts

.gitea/workflows/build-and-deploy.yml

@@ -42,12 +42,23 @@ jobs:
           echo "full=${REGISTRY_HOST}/${REPO}:${TAG}" >> "$GITHUB_OUTPUT"
           echo "latest=${REGISTRY_HOST}/${REPO}:latest" >> "$GITHUB_OUTPUT"
 
+      - name: Check Docker registry credentials
+        id: registry-check
+        run: |
+          if [ -n "${{ secrets.GITEA_TOKEN }}" ]; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Install Docker CLI
+        if: steps.registry-check.outputs.available == 'true'
         run: |
           apt-get update -qq
           apt-get install -y -qq docker.io
 
       - name: Log in to Gitea Container Registry
+        if: steps.registry-check.outputs.available == 'true'
         run: |
           echo "${{ secrets.GITEA_TOKEN }}" | \
             docker login "$REGISTRY_HOST" \
@@ -59,7 +70,7 @@ jobs:
         with:
           context: .
           file: ${{ env.DOCKERFILE_PATH }}
-          push: true
+          push: ${{ steps.registry-check.outputs.available == 'true' }}
           tags: |
             ${{ steps.image-meta.outputs.full }}
             ${{ steps.image-meta.outputs.latest }}