ci: speed up pipeline + shrink demo web image

CI (Gitea Actions, .github/workflows/ci.yml):
- CodeQL off the PR critical path: runs on push-to-main + a weekly cron only
  (`if: github.event_name != 'pull_request'`, `schedule: Mondays 03:00 UTC`).
  The 2-language 20-min matrix was the slowest thing on every PR; code is still
  scanned on main + weekly.
- Cache Playwright browsers (~/.cache/ms-playwright) in the storybook-a11y + e2e
  jobs — skips the chromium download on a hit; `install --with-deps` then only does
  the fast apt deps check.
- Cache NuGet (~/.nuget/packages, keyed on **/*.csproj — no packages.lock.json) in
  the backend / e2e / api-client-drift / codeql-csharp jobs.
- `npm ci --prefer-offline --no-audit --no-fund` in the 4 npm jobs.

Demo (docker-compose.yml, local only — NOT used by CI): web image node:24 →
node:24-slim (~1.1GB → 232MB verified). The container only runs `npm ci && ng serve`
and the native deps ship prebuilt glibc binaries, so slim needs no toolchain —
verified: npm ci clean, ng serve boots, app returns 200.

Note: CI timing/behaviour can only be confirmed on the Gitea runner (not observable
locally). Every change here is independently revertable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
     tags: ['v*']
   pull_request:
+  # CodeQL runs on main + this weekly cron only (not on PRs) — see the codeql job's `if`.
+  schedule:
+    - cron: '0 3 * * 1' # Mondays 03:00 UTC
 
 # Least privilege by default; the CodeQL job widens its own scope locally.
 permissions:
@@ -25,7 +28,7 @@ jobs:
         with:
           node-version: 24
           cache: npm
-      - run: npm ci
+      - run: npm ci --prefer-offline --no-audit --no-fund
       - run: npm run lint
       - run: npm run format:check
       - run: npm run check:tokens
@@ -47,7 +50,13 @@ jobs:
         with:
           node-version: 24
           cache: npm
-      - run: npm ci
+      - run: npm ci --prefer-offline --no-audit --no-fund
+      # Cache the chromium download across runs; `install --with-deps` then only
+      # runs the (fast, idempotent) apt deps check on a hit.
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
       - run: npx playwright install --with-deps chromium
       - run: npm run build-storybook
       - run: npm run test-storybook:ci
@@ -60,6 +69,11 @@ jobs:
       - uses: actions/setup-dotnet@v4
         with:
           dotnet-version: 10.0.x
+      - uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
+          restore-keys: nuget-${{ runner.os }}-
       - run: dotnet format backend/BigRegister.slnx --verify-no-changes
       - run: dotnet test backend/BigRegister.slnx
 
@@ -84,12 +98,24 @@ jobs:
       - uses: actions/setup-dotnet@v4
         with:
           dotnet-version: 10.0.x
-      - run: npm ci
+      - uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
+          restore-keys: nuget-${{ runner.os }}-
+      - run: npm ci --prefer-offline --no-audit --no-fund
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
       - run: npx playwright install --with-deps chromium
       - run: npm run e2e
 
   codeql:
     # Static analysis (SAST) for both sides; results appear under the Security tab.
+    # Off the PR path (slow 2-language matrix) — runs on push-to-main + the weekly
+    # cron only, so PR feedback isn't bottlenecked on it.
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
@@ -106,6 +132,12 @@ jobs:
         uses: actions/setup-dotnet@v4
         with:
           dotnet-version: 10.0.x
+      - if: matrix.language == 'csharp'
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
+          restore-keys: nuget-${{ runner.os }}-
       - uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
@@ -128,6 +160,11 @@ jobs:
           dotnet-version: |
             8.0.x
             10.0.x
-      - run: npm ci
+      - uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
+          restore-keys: nuget-${{ runner.os }}-
+      - run: npm ci --prefer-offline --no-audit --no-fund
       - run: npm run gen:api
       - run: git diff --exit-code src/app/shared/infrastructure/api-client.ts backend/swagger.json

docker-compose.yml

@@ -25,7 +25,10 @@ services:
       - '5000:5000'
 
   web:
-    image: node:24
+    # slim (Debian/glibc, ~220MB vs ~1.1GB for the full tag): the container only runs
+    # `npm ci && ng serve`, and the native deps (esbuild, lmdb, @parcel/watcher,
+    # msgpackr-extract) ship prebuilt glibc binaries, so no build toolchain is needed.
+    image: node:24-slim
     working_dir: /app
     # Uses the committed generated client (no codegen at startup); proxies /api → api container.
     # ponytail: `--no-fund --loglevel=error` silences npm 11's startup noise (deprecation +