Add frontend build and dependency audits to CI

Nothing previously checked that a PR still produces a working frontend
build -- add a job that type-checks and builds the Vue app. Also run
composer audit / npm audit so known CVEs in dependencies fail the build
rather than going unnoticed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -23,5 +23,26 @@ jobs:
       - name: Install dependencies
         run: composer install --no-progress --prefer-dist
 
+      - name: Audit dependencies
+        run: composer audit
+
       - name: Run tests
         run: vendor/bin/phpunit
+
+  frontend-build:
+    runs-on: ubuntu-latest
+    container: node:24-alpine
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Audit dependencies
+        run: npm audit --audit-level=high
+
+      - name: Type-check and build
+        run: npm run build