The auto-generated secrets.GITEA_TOKEN lacks write:package scope, causing npm publish to fail with E401. Use a dedicated repo secret NPM_PUBLISH_TOKEN with a personal access token that has write:package.
