ci: drop npm/node_modules cache — runner cache server is unreachable

The act_runner's internal cache server (172.17.0.2:46367) can't be reached
from job containers: `setup-node` with `cache: npm` spends ~4m42s on
`getCacheEntry failed: connect ETIMEDOUT` every build, then reports "npm cache
is not found" — ~5 min of pure cost for zero caching. The `actions/cache`
node_modules steps added in 79258668 would hit the same dead server and hang
too, so they're removed here as well.

Removing the cache usage reclaims ~5 min/build with no loss (nothing was being
cached). The fast-gates-before-build reorder is kept. Re-enable caching once
the runner's cache server is reachable from job containers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -30,8 +30,13 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version-file: '.node-version'
-          cache: npm
 
+      # No npm / node_modules cache: the act_runner's internal cache server is
+      # unreachable from job containers (`getCacheEntry failed: connect ETIMEDOUT
+      # 172.17.0.2`), so every cache restore hangs ~5 min and then fails — pure
+      # cost, zero benefit. `cache: npm` was removed from Setup Node above for the
+      # same reason. Re-enable both (setup-node `cache: npm` + an actions/cache
+      # node_modules step) once the runner's cache server is reachable from jobs.
       - name: Install dependencies
         # Harden against transient registry network failures (ECONNRESET etc.):
         # raise npm's built-in fetch retries/timeouts and retry `npm ci` up to
@@ -52,37 +57,36 @@ jobs:
             sleep $((attempt * 15))
           done
 
-      # ── Critical gate — if this fails, nothing deploys ──────────────────
+      # ── Quality gates run BEFORE the slow build so a format/lint/type/test
+      # error fails in seconds instead of after the ~minutes-long build. All are
+      # hard gates — any failure fails the job and blocks the deploy. The tree is
+      # held clean (prettier formatted, eslint 0 errors, typecheck 0), so these
+      # gate real regressions. NOTE: the lotus-build.sh upstream-merge path can
+      # deploy without CI; a later normal push surfaces any introduced issue here
+      # — fix forward (or briefly re-soften a gate) rather than deploy broken.
+      # eslint gates on errors only (existing no-explicit-any warnings stay
+      # informational — check:eslint has no --max-warnings).
+      - name: Prettier
+        run: npm run check:prettier
+
+      - name: ESLint
+        run: npm run check:eslint
+
+      - name: TypeScript
+        run: npm run typecheck
+
+      # Deterministic pure-logic tests on Node's built-in runner via tsx (no
+      # vitest — Vite 8 is ahead of vitest's range). A failure blocks the deploy.
+      - name: Unit tests
+        run: npm test
+
+      # ── Critical gate — if this fails, nothing deploys. Produces dist/. ──
       - name: Build
         run: npm run build
         env:
           NODE_OPTIONS: '--max_old_space_size=4096'
           VITE_APP_VERSION: ${{ github.sha }}
 
-      # Unit tests are a hard gate too — deterministic pure-logic tests on Node's
-      # built-in runner via tsx (no vitest — Vite 8 is ahead of vitest's range).
-      # A failure blocks the deploy.
-      - name: Unit tests
-        run: npm test
-
-      # ── Quality gates (hard — a failure fails the job and blocks deploy) ──
-      # The tree is held clean (typecheck 0, eslint 0 errors, prettier
-      # formatted), so these gate real regressions instead of relying on local
-      # runs. NOTE: an upstream-stable merge (the lotus-build.sh path) could
-      # introduce upstream type/lint/format issues; that path deploys without
-      # CI, but a subsequent normal push would surface the failure here — fix
-      # forward (or briefly re-soften a gate) rather than let it deploy broken.
-      # eslint gates on errors only (existing `no-explicit-any` warnings stay
-      # informational — `check:eslint` has no --max-warnings).
-      - name: TypeScript
-        run: npm run typecheck
-
-      - name: ESLint
-        run: npm run check:eslint
-
-      - name: Prettier
-        run: npm run check:prettier
-
       # ── Security (informational — findings shouldn't block a deploy) ─────
       - name: Audit (high/critical)
         run: npm audit --audit-level=high --omit=dev

.husky/pre-commit

@@ -1,3 +1 @@
-# These are commented until we enable lint and typecheck
-# npx tsc -p tsconfig.json --noEmit
-# npx lint-staged
+npx lint-staged