ci: revert go-version to 1.25, add npm ci fallback in frontend QC jobs

1.25.12 unavailable in runner toolcache — revert to '1.25' which resolves to latest patch. The GO-2026-5856 vuln requires a Go patch release not yet available. Frontend QC jobs now run npm ci before their command since cache restore alone doesn't guarantee node_modules.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

.gitea/workflows/ci.yaml

@@ -24,7 +24,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.25.12"
+          go-version: "1.25"
           cache: false
 
       - name: Cache Go modules
@@ -87,7 +87,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.25.12"
+          go-version: "1.25"
           cache: false
 
       - name: Cache Go modules
@@ -154,7 +154,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.25.12"
+          go-version: "1.25"
           cache: false
 
       - name: Cache Go modules
@@ -201,7 +201,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.25.12"
+          go-version: "1.25"
           cache: false
 
       - name: Cache Go modules
@@ -289,5 +289,8 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-npm-
 
+      - name: Ensure dependencies
+        run: cd frontend && npm ci
+
       - name: ${{ matrix.script }}
         run: cd frontend && ${{ matrix.cmd }}