ci: remove test/race timeouts, add concurrency cancel-in-progress, fix npm audit vulns

- Remove -timeout 180s/240s from go test and race commands
- Add concurrency group to cancel stale pipelines on new pushes
- Run npm update to bump Vite 7.3.5 -> 7.3.6, fixing nested esbuild vuln
- npm audit now at 0 vulnerabilities

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

frontend/src/lib/components/today/TodayCalendar.svelte

@@ -279,10 +279,7 @@
 	};
 
 	type TimelineItem =
-		| AppointmentTimelineItem
-		| BlockerTimelineItem
-		| LunchTimelineItem
-		| ClosingTimeTimelineItem;
+		AppointmentTimelineItem | BlockerTimelineItem | LunchTimelineItem | ClosingTimeTimelineItem;
 
 	const timeline = $derived.by(() => {
 		const items: TimelineItem[] = [];

frontend/src/routes/book/canvas.md

@@ -268,9 +268,7 @@ Move _all_ booking‑related state and logic out of `+page.svelte` into this fil
 	let selectedServices: Service[] = [];
 	let selectedDate;
 	let selectedTime: string | null = null;
-	let customerInfo: CustomerInfo = {
-		/* unchanged */
-	};
+	let customerInfo: CustomerInfo = {/* unchanged */};
 
 	// pricing, derived values, API calls stay here
 </script>