ci: speed up pipeline + shrink demo web image

CI (Gitea Actions, .github/workflows/ci.yml):
- CodeQL off the PR critical path: runs on push-to-main + a weekly cron only
  (`if: github.event_name != 'pull_request'`, `schedule: Mondays 03:00 UTC`).
  The 2-language 20-min matrix was the slowest thing on every PR; code is still
  scanned on main + weekly.
- Cache Playwright browsers (~/.cache/ms-playwright) in the storybook-a11y + e2e
  jobs — skips the chromium download on a hit; `install --with-deps` then only does
  the fast apt deps check.
- Cache NuGet (~/.nuget/packages, keyed on **/*.csproj — no packages.lock.json) in
  the backend / e2e / api-client-drift / codeql-csharp jobs.
- `npm ci --prefer-offline --no-audit --no-fund` in the 4 npm jobs.

Demo (docker-compose.yml, local only — NOT used by CI): web image node:24 →
node:24-slim (~1.1GB → 232MB verified). The container only runs `npm ci && ng serve`
and the native deps ship prebuilt glibc binaries, so slim needs no toolchain —
verified: npm ci clean, ng serve boots, app returns 200.

Note: CI timing/behaviour can only be confirmed on the Gitea runner (not observable
locally). Every change here is independently revertable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -25,7 +25,10 @@ services:
       - '5000:5000'
 
   web:
-    image: node:24
+    # slim (Debian/glibc, ~220MB vs ~1.1GB for the full tag): the container only runs
+    # `npm ci && ng serve`, and the native deps (esbuild, lmdb, @parcel/watcher,
+    # msgpackr-extract) ship prebuilt glibc binaries, so no build toolchain is needed.
+    image: node:24-slim
     working_dir: /app
     # Uses the committed generated client (no codegen at startup); proxies /api → api container.
     # ponytail: `--no-fund --loglevel=error` silences npm 11's startup noise (deprecation +