fix(frontend): the chunk guard's logic lives in the guard, so no file sits in two TypeScript projects

The guard's logic was a src/lib file the config project also listed. The app project, which
references the config project, then refuses that source on a clean build (TS6305) — while every
local run reused the referenced project's cached output and stayed green; only the Docker image
build failed. The logic is back inside chunkGuard.ts, its test beside it at the frontend root
(vitest now also collects `*.test.ts` there), and a gate contract fails when the config project's
include reaches into src/ again. The guard was re-proved on a build with a leaking re-export.

frontend/src/lib/gates.snapshot.json

@@ -1287,7 +1287,7 @@
       "export default defineConfig({",
       "  plugins: [reactWithCompiler()],",
       "  test: {",
-      "    include: [\"src/**/*.test.{ts,tsx}\"],",
+      "    include: [\"src/**/*.test.{ts,tsx}\", \"*.test.ts\"],",
       "    environment: \"node\",",
       "    coverage: {",
       "      provider: \"v8\",",