ci: split frontend into build gate then parallel typecheck/lint/audit

npm run build runs first as the gate. On success, typecheck, lint, and npm audit fire in parallel — all restoring node_modules from the build job's cache.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

.gitea/workflows/ci.yaml

@@ -225,8 +225,8 @@ jobs:
           go install golang.org/x/vuln/cmd/govulncheck@latest
           govulncheck ./...
 
-  frontend:
+  frontend-build:
-    name: Frontend lint & types
+    name: Frontend build (gate)
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -249,13 +249,45 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-npm-
 
-      - name: Frontend type check
+      - name: Install dependencies
-        run: |
+        run: cd frontend && npm ci
-          cd frontend
-          npm ci
-          npm run check
 
-      - name: Frontend lint
+      - name: Build
+        run: cd frontend && npm run build
+
+  frontend-qc:
+    name: Frontend ${{ matrix.script }}
+    needs: [frontend-build]
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: sh
+    strategy:
+      matrix:
+        include:
+          - script: typecheck
+            cmd: npm run check
+          - script: lint
+            cmd: npm run lint
+          - script: audit
+            cmd: npm audit --audit-level=high
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Fix node toolcache path for Post-step cleanup
         run: |
-          cd frontend
+          mkdir -p /opt/hostedtoolcache/node/22.23.1/x64/bin
-          npm run lint
+          ln -sf /usr/local/bin/node /opt/hostedtoolcache/node/22.23.1/x64/bin/node
+
+      - name: Restore npm dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.npm
+            frontend/node_modules
+          key: ${{ runner.os }}-npm-${{ hashFiles('frontend/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
+
+      - name: ${{ matrix.script }}
+        run: cd frontend && ${{ matrix.cmd }}