fix(frontend): the chunk guard's logic lives in the guard, so no file sits in two TypeScript projects

The guard's logic was a src/lib file the config project also listed. The app project, which
references the config project, then refuses that source on a clean build (TS6305) — while every
local run reused the referenced project's cached output and stayed green; only the Docker image
build failed. The logic is back inside chunkGuard.ts, its test beside it at the frontend root
(vitest now also collects `*.test.ts` there), and a gate contract fails when the config project's
include reaches into src/ again. The guard was re-proved on a build with a leaking re-export.

frontend/src/lib/gates.contract.test.ts

@@ -472,7 +472,7 @@ describe("the gate register (docs/gates.md)", () => {
       "reactPlugin.ts",
       "devOnlyGuard.ts",
       "chunkGuard.ts",
-      "src/lib/chunkLeaks.ts",
+      "chunkGuard.test.ts",
       "playwright.config.ts",
       "postcss.config.js",
     ],
@@ -490,6 +490,14 @@ describe("the gate register (docs/gates.md)", () => {
     }
     expect(missingFrom(found)).toEqual([]);
   });
+  it("puts no file in two projects", () => {
+    // A src file the config project also lists builds into that project's output, and the app
+    // project (which references it) then refuses the source (TS6305) — but only on a clean
+    // build: a local run reuses the referenced project's cached output and stays green, so only
+    // the Docker image build said so.
+    const node = jsonc("frontend/tsconfig.node.json").include as string[];
+    expect(node.filter((f) => f === "src" || f.startsWith("src/"))).toEqual([]);
+  });
   it("type-checks every config file at the frontend root, or lists it", () => {
     const checked = new Set(INCLUDE["frontend/tsconfig.node.json"]);
     const roots = readdirSync(FRONTEND).filter((f) => /[.](ts|js|mjs|cjs)$/.test(f));