deac
9df18983c3
npm ci fails with E401 when a consuming repo's package-lock.json pins a package to the private Gitea npm registry, since these composite actions never write an .npmrc or set a registry auth token. Add an optional NPM_TOKEN input that writes .npmrc before install; existing consumers that don't pass it are unaffected.