Fix anonymous registry push X-Registry-Auth EOF error

Docker requires a valid X-Registry-Auth header on push; send empty
anonymous credentials for ttl.sh and other no-auth targets.

server/handlers/images.js

@@ -30,6 +30,22 @@ function dockerAuthOpts(authconfig) {
   }
 }
 
+/**
+ * Docker Engine requires X-Registry-Auth on image push.
+ * Omitting it (or sending an empty header) yields:
+ *   "missing X-Registry-Auth: invalid X-Registry-Auth header: EOF"
+ * Anonymous registries (ttl.sh, public Hub) need a valid empty-cred payload.
+ * @returns {{ username: string, password: string, email: string, serveraddress: string }}
+ */
+export function anonymousRegistryAuth() {
+  return {
+    username: '',
+    password: '',
+    email: '',
+    serveraddress: '',
+  }
+}
+
 /**
  * @param {unknown} err
  * @returns {boolean}
@@ -89,6 +105,9 @@ async function pullImageStream(session, imageName, auth) {
  * stringifies undefined as the literal "undefined", which Docker treats as a
  * real tag (e.g. repo:undefined → "tag does not exist").
  *
+ * Always sets authconfig: usable credentials when present, otherwise anonymous
+ * empty credentials so Docker still gets a valid X-Registry-Auth header.
+ *
  * @param {{ tag?: string|null, authconfig?: object|null }} opts
  * @returns {Record<string, unknown>}
  */
@@ -97,7 +116,7 @@ export function buildImagePushOpts(opts = {}) {
   const tag = opts.tag != null ? String(opts.tag).trim() : ''
   if (tag) out.tag = tag
   const auth = dockerAuthOpts(opts.authconfig || null)
-  if (auth) out.authconfig = auth
+  out.authconfig = auth || anonymousRegistryAuth()
   return out
 }