ci: remove test/race timeouts, add concurrency cancel-in-progress, fix npm audit vulns

- Remove -timeout 180s/240s from go test and race commands
- Add concurrency group to cancel stale pipelines on new pushes
- Run npm update to bump Vite 7.3.5 -> 7.3.6, fixing nested esbuild vuln
- npm audit now at 0 vulnerabilities

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

.gitea/workflows/ci.yaml

@@ -7,6 +7,10 @@ on:
       - develop
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   POSTGRES_USER: myuser
   POSTGRES_PASSWORD: mypassword
@@ -121,7 +125,7 @@ jobs:
 
       - name: Run tests
         working-directory: backend
-        run: go test -tags "${{ matrix.gotags }}" -count=1 ${{ matrix.verbose }} -timeout 180s ./...
+        run: go test -tags "${{ matrix.gotags }}" -count=1 ${{ matrix.verbose }} ./...
         env:
           POSTGRES_HOST: postgres
           TEST_DB_HOST: postgres
@@ -191,7 +195,7 @@ jobs:
 
       - name: Run race detector
         working-directory: backend
-        run: go test -tags "${{ matrix.gotags }}" -race -count=1 -timeout 240s ./...
+        run: go test -tags "${{ matrix.gotags }}" -race -count=1 ./...
         env:
           POSTGRES_HOST: postgres
           TEST_DB_HOST: postgres