Instead of skipping the frontend test when vitest is not installed, security-gate.sh now runs `npm ci -w frontend` automatically. Also add `cache: "npm"` to security-gate's actions/setup-node so the npm cache from the frontend-tests job is reused — prevents OOM on the 1GB VPS (cache restore is disk-only, not 300MB download). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>