make action pr auth failures explicit

.gitea/workflows/helium-update.yml

@@ -86,7 +86,7 @@ jobs:
       - name: open pull request
         if: steps.update.outputs.updated == 'true'
         env:
-          GITEA_TOKEN: ${{ secrets.tea_token }}
+          GITEA_TOKEN: ${{ secrets.tea_token || secrets.TEA_TOKEN }}
         shell: bash
         run: |
           set -euo pipefail
@@ -94,6 +94,11 @@ jobs:
           api="https://gitea.unrail.xyz/api/v1/repos/thomas/nixos-config"
           branch="bot/helium-${{ steps.update.outputs.version }}"
 
+          if [ -z "${GITEA_TOKEN:-}" ]; then
+            echo "GITEA_TOKEN is empty (check repo secret tea_token/TEA_TOKEN)"
+            exit 1
+          fi
+
           # Skip if PR for this branch already exists
           existing=$(curl -fsS \
             -H "Authorization: token ${GITEA_TOKEN}" \