fix(frontend): the chunk guard's logic lives in the guard, so no file sits in two TypeScript projects

The guard's logic was a src/lib file the config project also listed. The app project, which
references the config project, then refuses that source on a clean build (TS6305) — while every
local run reused the referenced project's cached output and stayed green; only the Docker image
build failed. The logic is back inside chunkGuard.ts, its test beside it at the frontend root
(vitest now also collects `*.test.ts` there), and a gate contract fails when the config project's
include reaches into src/ again. The guard was re-proved on a build with a leaking re-export.

frontend/tsconfig.node.json

@@ -44,7 +44,7 @@
     "reactPlugin.ts",
     "devOnlyGuard.ts",
     "chunkGuard.ts",
-    "src/lib/chunkLeaks.ts",
+    "chunkGuard.test.ts",
     "playwright.config.ts",
     "postcss.config.js"
   ]