ci(frontend): add vitest job to Forgejo Actions gate

Run the merged frontend vitest suite on every frontend-touching PR so the
tests don't rot. Mirrors the #1032 backend gate: per-job dorny/paths-filter
(new `frontend` output, `frontend/**`), node:20 + npm cache on the lockfile,
`npm ci --legacy-peer-deps --no-audit --no-fund` (exact frontend/Dockerfile
flags), then `npm run test`. Additive — backend-tests job unchanged; no
top-level paths filter so frontend-only PRs already trigger the workflow.
Making frontend-tests a required check is a follow-up in the Forgejo UI.

Refs #999.

.forgejo/workflows/ci.yml

@@ -43,6 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       backend: ${{ steps.filter.outputs.backend }}
+      frontend: ${{ steps.filter.outputs.frontend }}
     steps:
       - uses: actions/checkout@v4
       - uses: dorny/paths-filter@v3
@@ -53,6 +54,9 @@ jobs:
               - 'backend/**'
               - 'data/sql/**'
               - '.forgejo/workflows/ci.yml'
+            frontend:
+              - 'frontend/**'
+              - '.forgejo/workflows/ci.yml'
 
   backend-tests:
     runs-on: ubuntu-latest
@@ -116,3 +120,35 @@ jobs:
         #   (5432 недоступен в этом mock-lane) → SKIP. Это intended.
         # PDF-тесты ИДУТ (libpango выше). Target: 0 failed, skips OK.
         run: uv run pytest -q --ignore=tests/smoke
+
+  frontend-tests:
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.frontend == 'true'
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node
+        # Node 20 — совпадает с major из frontend/Dockerfile (node:20-alpine).
+        # cache=npm + cache-dependency-path на lockfile → переиспользуем ~/.npm
+        # между прогонами (mirror Dockerfile's `--mount=type=cache,target=/root/.npm`).
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install deps (npm ci, frozen lockfile)
+        # ТОЧНЫЕ флаги из frontend/Dockerfile (deps stage):
+        # --legacy-peer-deps — Tailwind 4 alpha + React 19 peer-dep mismatches;
+        # --no-audit --no-fund — тише и быстрее в CI. `ci` (не `install`) =
+        # детерминированно из package-lock.json, fail при дрейфе lock vs package.json.
+        run: npm ci --legacy-peer-deps --no-audit --no-fund
+
+      - name: Test (vitest)
+        # `npm run test` = `vitest run` (single-shot, не watch). Только тесты —
+        # `next build` НАМЕРЕННО не здесь (тяжёлый, verified в deploy.yml build).
+        run: npm run test