fix(frontend): the chunk guard's logic lives in the guard, so no file sits in two TypeScript projects

The guard's logic was a src/lib file the config project also listed. The app project, which
references the config project, then refuses that source on a clean build (TS6305) — while every
local run reused the referenced project's cached output and stayed green; only the Docker image
build failed. The logic is back inside chunkGuard.ts, its test beside it at the frontend root
(vitest now also collects `*.test.ts` there), and a gate contract fails when the config project's
include reaches into src/ again. The guard was re-proved on a build with a leaking re-export.

frontend/vitest.config.ts

@@ -17,7 +17,8 @@ export default defineConfig({
   test: {
     // .tsx included on purpose: a test file the glob misses does not fail, it is simply never
     // collected, and the gate still prints green.
-    include: ["src/**/*.test.{ts,tsx}"],
+    // …and the build plugins' own tests beside them at the frontend root (chunkGuard).
+    include: ["src/**/*.test.{ts,tsx}", "*.test.ts"],
     environment: "node",
     // A coverage REPORT on demand (`npm run test -- --coverage`), never enforced and not in the gate:
     // "every regression test seen red" is the bar, not a percentage.