fix(ci): security-gate auto-installs frontend deps if vitest missing

Instead of skipping the frontend test when vitest is not installed,
security-gate.sh now runs `npm ci -w frontend` automatically.

Also add `cache: "npm"` to security-gate's actions/setup-node so the
npm cache from the frontend-tests job is reused — prevents OOM on
the 1GB VPS (cache restore is disk-only, not 300MB download).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -66,6 +66,8 @@ jobs:
         uses: actions/setup-node@v3
         with:
           node-version: "20"
+          cache: "npm"
+          cache-dependency-path: AINative_OKR_CASAN5/package-lock.json
 
       - name: Install test tools
         run: |

AINative_OKR_CASAN5/.specify/scripts/bash/security-gate.sh

@@ -41,10 +41,14 @@ if [[ -d "$FNM_NODE_DIR" ]]; then
   NODE_BIN=$(find "$FNM_NODE_DIR" -name "node.exe" -maxdepth 4 2>/dev/null | sort -V | tail -1)
   [[ -n "$NODE_BIN" ]] && export PATH="$(dirname "$NODE_BIN"):$PATH"
 fi
-if command -v node >/dev/null 2>&1 && [[ -f "$ROOT/node_modules/.bin/vitest" ]]; then
+if command -v node >/dev/null 2>&1; then
+  if [[ ! -f "$ROOT/node_modules/.bin/vitest" ]]; then
+    echo "  installing frontend deps (vitest not found)..."
+    npm ci -w frontend --prefix "$ROOT" >/dev/null 2>&1 || true
+  fi
   run "frontend runtime tests (WV4-A)"  bash -c "cd '$ROOT' && npm test -w frontend"
 else
-  echo "  GATE SKIP  frontend runtime tests (vitest not installed — covered by frontend-tests CI job)"; SKIP=$((SKIP+1))
+  echo "  GATE SKIP  frontend runtime tests (node not in PATH)"; SKIP=$((SKIP+1))
 fi
 
 echo "== verdict: PASS=$PASS FAIL=$FAIL SKIP=$SKIP =="