ci(deploy): name the missing secret instead of failing inside ssh

A missing RSYNC_SSH_KEY first surfaced as ssh failing to parse an empty
identity file, which names neither the secret nor where to set it. Adds
a preflight that lists exactly which secrets are absent, and notes that
HF_TOKEN is optional and only needed for gated repositories.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XZG2i4AmfSqE97EJGBVb64

.gitea/workflows/deploy.yml

@@ -59,6 +59,26 @@ jobs:
           name: rustingface
           path: dist
 
+      # Without this, a missing secret first surfaces as ssh failing to parse an
+      # empty key, which names neither the secret nor the fix.
+      - name: check the required secrets are set
+        env:
+          RSYNC_SSH_KEY: ${{ secrets.RSYNC_SSH_KEY }}
+          S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+          S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}
+        run: |
+          missing=""
+          for name in RSYNC_SSH_KEY S3_ACCESS_KEY_ID S3_SECRET_ACCESS_KEY; do
+            [ -n "${!name:-}" ] || missing="$missing $name"
+          done
+          if [ -n "$missing" ]; then
+            echo "missing repo secret(s):$missing" >&2
+            echo "Set them in Settings > Actions > Secrets. HF_TOKEN is optional and" >&2
+            echo "only needed for gated repositories." >&2
+            exit 1
+          fi
+          echo "all required secrets are present"
+
       - name: authenticate to the target
         run: |
           install -d -m 0700 ~/.ssh