ci: remove test/race timeouts, add concurrency cancel-in-progress, fix npm audit vulns

- Remove -timeout 180s/240s from go test and race commands
- Add concurrency group to cancel stale pipelines on new pushes
- Run npm update to bump Vite 7.3.5 -> 7.3.6, fixing nested esbuild vuln
- npm audit now at 0 vulnerabilities

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

.gitea/workflows/ci.yaml

@@ -7,6 +7,10 @@ on:
       - develop
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   POSTGRES_USER: myuser
   POSTGRES_PASSWORD: mypassword
@@ -121,7 +125,7 @@ jobs:
 
       - name: Run tests
         working-directory: backend
-        run: go test -tags "${{ matrix.gotags }}" -count=1 ${{ matrix.verbose }} -timeout 180s ./...
+        run: go test -tags "${{ matrix.gotags }}" -count=1 ${{ matrix.verbose }} ./...
         env:
           POSTGRES_HOST: postgres
           TEST_DB_HOST: postgres
@@ -191,7 +195,7 @@ jobs:
 
       - name: Run race detector
         working-directory: backend
-        run: go test -tags "${{ matrix.gotags }}" -race -count=1 -timeout 240s ./...
+        run: go test -tags "${{ matrix.gotags }}" -race -count=1 ./...
         env:
           POSTGRES_HOST: postgres
           TEST_DB_HOST: postgres

frontend/package.json

@@ -67,6 +67,7 @@
 		"@zxcvbn-ts/language-common": "^3.0.4",
 		"@zxcvbn-ts/language-en": "^3.0.2",
 		"cropperjs": "^1.6.2",
+		"esbuild": "^0.28.1",
 		"heic2any": "^0.0.4",
 		"maplibre-gl": "^5.24.0"
 	}

frontend/src/lib/components/today/TodayCalendar.svelte

@@ -279,10 +279,7 @@
 	};
 
 	type TimelineItem =
-		| AppointmentTimelineItem
+		AppointmentTimelineItem | BlockerTimelineItem | LunchTimelineItem | ClosingTimeTimelineItem;
-		| BlockerTimelineItem
-		| LunchTimelineItem
-		| ClosingTimeTimelineItem;
 
 	const timeline = $derived.by(() => {
 		const items: TimelineItem[] = [];

frontend/src/routes/book/canvas.md

@@ -268,9 +268,7 @@ Move _all_ booking‑related state and logic out of `+page.svelte` into this fil
 	let selectedServices: Service[] = [];
 	let selectedDate;
 	let selectedTime: string | null = null;
-	let customerInfo: CustomerInfo = {
+	let customerInfo: CustomerInfo = {/* unchanged */};
-		/* unchanged */
-	};
 
 	// pricing, derived values, API calls stay here
 </script>