ci: extract frontend deps checks into separate gating job

frontend-deps runs npm outdated + stale override checks as its own job. frontend-build waits for frontend-deps before starting, so stale deps stop the pipeline before build resources are consumed.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

.gitea/workflows/ci.yaml

@@ -236,8 +236,8 @@ jobs:
           go install golang.org/x/vuln/cmd/govulncheck@latest
           govulncheck ./...
 
-  frontend-build:
-    name: Frontend build (gate)
+  frontend-deps:
+    name: Frontend deps check
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -325,6 +325,34 @@ jobs:
           console.log('All overrides appear necessary');
           "
 
+  frontend-build:
+    name: Frontend build (gate)
+    needs: [frontend-deps]
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: sh
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Fix node toolcache path for Post-step cleanup
+        run: |
+          mkdir -p /opt/hostedtoolcache/node/22.23.1/x64/bin
+          ln -sf /usr/local/bin/node /opt/hostedtoolcache/node/22.23.1/x64/bin/node
+
+      - name: Cache npm dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.npm
+            frontend/node_modules
+          key: ${{ runner.os }}-npm-${{ hashFiles('frontend/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-
+
+      - name: Install dependencies
+        run: cd frontend && npm ci
+
       - name: Build
         run: cd frontend && npm run build