build: CI builds the bundle and audits what ships; the toolchain advisories are cleared

The server gate adds `vite build` (and with it devOnlyGuard, which until now
first ran inside the image build, after main was pushed) and
`npm audit --omit=dev --audit-level=high`. pip-audit is blocking: when it was
finally read it held three urllib3 advisories with a fix available.
urllib3 goes 2.7.0 -> 2.8.0 as a single in-place pin, passing pip check,
rather than a regeneration that would move every package.

The dev toolchain's 18 advisories are gone:
- vite 5 -> 6.4.3 (path traversal, fs.deny bypass, and esbuild <= 0.24.2
  through it);
- vitest 3 -> 4.1.11 (mocker path traversal);
- typescript-eslint 8.46 -> 8.71;
- `npm audit fix` for the rest.
tsc, eslint, knip, all 2269 tests and the build pass unchanged.

scripts/check-node-modules.mjs checks that frontend/node_modules holds
exactly what package-lock.json pins. The local gate's frontend lanes judge
the host tree, and nothing tied it to the lock the image installs.

.gitea/workflows/check.yml

@@ -1,7 +1,9 @@
 # Server-side mirror of the local `siftlode check` gate (E1 S3 / DX-1), so `main` is always green
 # independent of any one machine. Two jobs match the two local lanes:
-#   frontend — tsc (3 projects) + eslint + prettier --check + knip + vitest
-#   backend  — ruff + the full pytest suite (pure-logic + the DB-backed lane) against a real Postgres
+#   frontend — tsc (3 projects) + eslint + prettier --check + knip (both modes) + vitest + vite build
+#              + npm audit of the production dependencies
+#   backend  — ruff + basedpyright + the full pytest suite (pure-logic + the DB-backed lane) against
+#              a real Postgres + pip-audit of the lock
 #
 # They are declared side by side but they DO NOT run in parallel: the lab has a single act_runner
 # with one slot, so they queue. Measured across runs #86-#91 — the backend job starts at the exact
@@ -56,6 +58,12 @@ jobs:
       - run: npm run format:check
       - run: npm run knip
       - run: npm run test
+      # The production bundle (E32): before this, `vite build` — and devOnlyGuard, which fails it if
+      # dev-only code reaches the bundle — first ran inside the image build, after main was pushed.
+      - run: npx vite build
+      # What ships to the browser: a known CVE at high or above in a production dependency fails.
+      # (The dev tooling's own advisories are burned down by hand; see docs/gates.md.)
+      - run: npm audit --omit=dev --audit-level=high
 
   backend:
     runs-on: ubuntu-latest
@@ -112,8 +120,9 @@ jobs:
       - name: pytest
         run: python -m pytest
         working-directory: backend
-      # Dependency CVE audit over the pinned lock. Non-blocking for now (informational) — a real CVE
-      # shows up in the run without failing the gate; tighten to a hard fail once the noise is known.
-      - name: pip-audit (advisory)
+      # Dependency CVE audit over the pinned lock. BLOCKING since E32: it ran advisory-only, and when
+      # it was finally read it had three urllib3 advisories with a fix available (bumped in the same
+      # change). An advisory without a fix is answered with `--ignore-vuln <id>` here, a reason and a
+      # date in the comment, and a line in docs/gates.md.
+      - name: pip-audit
         run: pip install --no-cache-dir pip-audit && pip-audit -r backend/requirements.lock
-        continue-on-error: true

backend/requirements.lock

@@ -1,7 +1,10 @@
 # Pinned dependency lock for reproducible builds (SEC-5). GENERATED — do not hand-edit.
 # Source of truth is requirements.txt (the floor ranges); regenerate after editing it with:
 #   docker run --rm -v "$PWD":/b python:3.12-slim sh -c 'pip install -q -r /b/requirements.txt && pip freeze --exclude pip --exclude setuptools --exclude wheel' | sort
-# The prod Dockerfile + Dockerfile.test + CI install THIS file; pip-audit scans it in CI.
+# The prod Dockerfile + Dockerfile.test + CI install THIS file; pip-audit scans it in CI (blocking
+# since E32). A security fix may be ONE pin bumped in place instead of a full regeneration, which
+# would move every other package too — then `pip install -r requirements.lock && pip check` must
+# pass. In place so far: urllib3 2.7.0 -> 2.8.0 (PYSEC-2026-4175/4176/4177, E32).
 APScheduler==3.11.3
 Authlib==1.7.2
 Mako==1.4.1
@@ -53,7 +56,7 @@ starlette==1.6.0
 typing-inspection==0.4.4
 typing_extensions==4.16.0
 tzlocal==5.4.4
-urllib3==2.7.0
+urllib3==2.8.0
 uvicorn==0.52.3
 uvloop==0.22.1
 watchfiles==1.2.0

frontend/package.json

@@ -63,8 +63,8 @@
     "prettier": "3.6.2",
     "tailwindcss": "^4.3.3",
     "typescript": "^5.5.3",
-    "typescript-eslint": "8.46.0",
-    "vite": "^5.3.4",
-    "vitest": "^3.2.7"
+    "typescript-eslint": "8.71.0",
+    "vite": "^6.4.3",
+    "vitest": "^4.1.11"
   }
 }

scripts/check-node-modules.mjs

@@ -0,0 +1,40 @@
+#!/usr/bin/env node
+// Does frontend/node_modules hold exactly what frontend/package-lock.json pins? (E32)
+//
+// The local gate's frontend lanes run against the HOST's node_modules, and nothing tied that tree to
+// the lock: a `git pull` that bumped a dependency, or an `npm install` that was never committed, left
+// tsc/eslint/vitest judging the code against packages the build image (`npm ci`) does not use — a
+// green that proves nothing about what ships, in either direction. CI is immune (it runs `npm ci`);
+// this makes the local lanes say so instead of quietly differing.
+//
+// Checks every package the lock places under node_modules/: present, at the pinned version. A package
+// marked `optional` may be absent (a platform binary for another OS). Exit 1 with the list and the
+// one command that fixes it.
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const FRONTEND = join(dirname(fileURLToPath(import.meta.url)), "..", "frontend");
+const lock = JSON.parse(readFileSync(join(FRONTEND, "package-lock.json"), "utf8"));
+
+const problems = [];
+for (const [path, entry] of Object.entries(lock.packages ?? {})) {
+  if (!path.startsWith("node_modules/") || entry.link) continue;
+  const manifest = join(FRONTEND, path, "package.json");
+  if (!existsSync(manifest)) {
+    if (!entry.optional) problems.push(`missing   ${path.slice(13)}@${entry.version}`);
+    continue;
+  }
+  const installed = JSON.parse(readFileSync(manifest, "utf8")).version;
+  if (installed !== entry.version)
+    problems.push(`mismatch  ${path.slice(13)}: installed ${installed}, lock pins ${entry.version}`);
+}
+
+if (problems.length) {
+  console.error(`frontend/node_modules does not match package-lock.json (${problems.length}):`);
+  for (const p of problems.slice(0, 20)) console.error(`  ${p}`);
+  if (problems.length > 20) console.error(`  … and ${problems.length - 20} more`);
+  console.error("Fix: cd frontend && npm ci");
+  process.exit(1);
+}
+console.log(`node_modules matches package-lock.json (${Object.keys(lock.packages).length - 1} entries)`);