fix(ci): remove npm ci from security-gate — OOM-killed act-runner on 1GB VPS

security-gate job was downloading ~300MB of React/Vite npm packages unnecessarily.
casan-step.mjs uses only node:child_process, node:fs, node:os (built-ins) — no
npm packages needed. Removing npm ci -w frontend saves ~300MB peak RAM in CI.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -76,9 +76,6 @@ jobs:
           echo "jq: $(jq --version)"
           echo "openssl: $(openssl version)"
 
-      - name: Install frontend dependencies
-        run: npm ci -w frontend
-
       - name: Vault KMS — enable transit + pre-create keys
         run: |
           if curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then