fix(ci): run security-gate after frontend-tests to prevent OOM on 1GB VPS

Both jobs running concurrently (two 512MB containers + gitea + vault) exhausted
the 1GB RAM. Make security-gate sequential with needs: [frontend-tests].
Also fix health-check to use docker ps instead of curl localhost (DooD mode).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -49,6 +49,7 @@ jobs:
   security-gate:
     name: "CASAN Security Gate + Vault KMS (H4/H5)"
     runs-on: ubuntu-latest
+    needs: [frontend-tests]
     defaults:
       run:
         working-directory: AINative_OKR_CASAN5
@@ -189,10 +190,12 @@ jobs:
         run: |
           echo "Waiting 20 s for containers to initialise..."
           sleep 20
-          if curl -sf http://localhost/ -o /dev/null; then
+          echo "=== Running containers ==="
+          docker ps --filter "name=okr" --format "{{.Names}}\t{{.Status}}\t{{.Ports}}"
+          if docker ps --filter "name=okr-frontend" --filter "status=running" | grep -q okr-frontend; then
             echo "DEPLOY_OK  frontend=http://161.33.139.73"
           else
-            echo "DEPLOY_WARN frontend check failed — dumping logs"
+            echo "DEPLOY_WARN containers not fully running — dumping logs"
             docker logs okr-frontend --tail 30 || true
             docker logs okr-backend  --tail 30 || true
           fi