npm ci fails with E401 when a consuming repo's package-lock.json pins a
package to the private Gitea npm registry, since these composite actions
never write an .npmrc or set a registry auth token. Add an optional
NPM_TOKEN input that writes .npmrc before install; existing consumers that
don't pass it are unaffected.
deac