ci: add dependency staleness check to frontend build gate

After npm ci, runs npm outdated --json and fails if any in-range (current != wanted) updates exist. Developer must run npm update locally and commit the lockfile.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

.gitea/workflows/ci.yaml

@@ -263,6 +263,25 @@ jobs:
       - name: Install dependencies
         run: cd frontend && npm ci
 
+      - name: Check for in-range dependency updates
+        run: |
+          cd frontend && npm outdated --json 2>&1 | node -e "
+          const chunks = [];
+          process.stdin.on('data', c => chunks.push(c));
+          process.stdin.on('end', () => {
+            const raw = Buffer.concat(chunks).toString().trim();
+            if (!raw) { console.log('No dependencies to check'); process.exit(0); }
+            const data = JSON.parse(raw);
+            const updates = Object.entries(data).filter(([_, v]) => v.current !== v.wanted);
+            if (updates.length) {
+              console.log('In-range updates available — run \"npm update\" locally and commit:');
+              updates.forEach(([k, v]) => console.log('  ' + k + ': ' + v.current + ' -> ' + v.wanted));
+              process.exit(1);
+            }
+            console.log('All dependencies up to date within semver range');
+          });
+          "
+
       - name: Build
         run: cd frontend && npm run build