cicd fixes and desktop fix

.gitea/workflows/android-release.yml

@@ -96,7 +96,7 @@ jobs:
             fi
           fi
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v3
         with:
           name: kadence-release-apk
           path: android/app/build/outputs/apk/release/app-release.apk

.gitea/workflows/docker.yml

@@ -15,6 +15,14 @@ on:
     branches: [master]
     tags: ["v*"]
 
+# The built-in job token is enough to push to this instance's own registry; a
+# REGISTRY_TOKEN secret is only needed when it is not (an older Gitea, or a
+# restricted default permission mode). Ask for packages: write explicitly so the
+# token is not silently read-only on instances that default to restricted.
+permissions:
+  contents: read
+  packages: write
+
 env:
   REGISTRY: git.timka.su
   IMAGE: git.timka.su/timka123/kadence
@@ -35,7 +43,10 @@ jobs:
           # so a missing REGISTRY_USER secret does not fail the job with docker's
           # unhelpful "username is empty".
           REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.repository_owner }}
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          # Gitea gives every job a built-in token (secrets.GITEA_TOKEN). Prefer
+          # an explicit secret, but fall back to that token so a fresh repository
+          # publishes without anyone having to mint one by hand.
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || secrets.GITEA_TOKEN }}
         run: |
           if [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_TOKEN" ]; then
             echo "::error::Container registry credentials are missing. Set REGISTRY_TOKEN (a token with package:write) under Settings → Actions → Secrets; REGISTRY_USER is optional and defaults to the repository owner."