build: CI builds the bundle and audits what ships; the toolchain advisories are cleared

The server gate adds `vite build` (and with it devOnlyGuard, which until now
first ran inside the image build, after main was pushed) and
`npm audit --omit=dev --audit-level=high`. pip-audit is blocking: when it was
finally read it held three urllib3 advisories with a fix available.
urllib3 goes 2.7.0 -> 2.8.0 as a single in-place pin, passing pip check,
rather than a regeneration that would move every package.

The dev toolchain's 18 advisories are gone:
- vite 5 -> 6.4.3 (path traversal, fs.deny bypass, and esbuild <= 0.24.2
  through it);
- vitest 3 -> 4.1.11 (mocker path traversal);
- typescript-eslint 8.46 -> 8.71;
- `npm audit fix` for the rest.
tsc, eslint, knip, all 2269 tests and the build pass unchanged.

scripts/check-node-modules.mjs checks that frontend/node_modules holds
exactly what package-lock.json pins. The local gate's frontend lanes judge
the host tree, and nothing tied it to the lock the image installs.

frontend/package.json

@@ -63,8 +63,8 @@
     "prettier": "3.6.2",
     "tailwindcss": "^4.3.3",
     "typescript": "^5.5.3",
-    "typescript-eslint": "8.46.0",
-    "vite": "^5.3.4",
-    "vitest": "^3.2.7"
+    "typescript-eslint": "8.71.0",
+    "vite": "^6.4.3",
+    "vitest": "^4.1.11"
   }
 }