docs(backlog): WP-30 — CI performance follow-ups

Capture the deferred CI options from the speed pass (708d4c2) so they aren't lost:
node_modules cache to skip npm ci, smaller CI runner image (act_runner label→image,
needs admin; or repo-only container: for node-only jobs), path-filtered jobs, a fast
split lint job, and an optional lean prod backend image. Notes the constraints (CI not
observable from the agent env; compose images aren't used by CI). Added the README row.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/project/backlog/README.md

@@ -44,7 +44,7 @@ Gates land before the work they cover; each lint rule lands in the same WP as th
 for its existing violations, so every WP ends green.
 
 | WP                                       | Title                                                                      | Phase                       | Status |
-| ---------------------------------------- | ------------------------------------------------------------ | --------------------------- | ------ |
+| ---------------------------------------- | -------------------------------------------------------------------------- | --------------------------- | ------ |
 | [WP-01](WP-01-axe-ci-gate.md)            | Axe-on-every-story CI gate                                                 | 0 · gates                   | done   |
 | [WP-02](WP-02-check-tokens.md)           | Harden `check:tokens` + fix what it catches                                | 0 · gates                   | done   |
 | [WP-03](WP-03-contracts-purity.md)       | Boundaries I: contracts purity + ApiClient confinement                     | 0 · gates                   | done   |
@@ -74,6 +74,7 @@ for its existing violations, so every WP ends green.
 | [WP-27](WP-27-brief-ux-layer.md)         | Brief UX layer (undo/redo, standaardbrief, diff)                           | 6 · Brief v2                | todo   |
 | [WP-28](WP-28-brief-v2-demo-polish.md)   | Brief v2 demo polish (scenarios, e2e, docs)                                | 6 · Brief v2                | todo   |
 | [WP-29](WP-29-stamdata-beheer-editor.md) | Stamdata beheer editor (low-code, PR-emitting)                             | follow-on · ADR-0004        | done   |
+| [WP-30](WP-30-ci-perf-followups.md)      | CI performance follow-ups (node_modules cache, runner image, path filters) | follow-on · CI/infra        | todo   |
 
 Sequencing dependencies (stated in the WPs too): 01 before 10–15 (axe covers story churn);
 03/04 before 05–09 (boundaries stop new violations during refactors); 06 before 07 (typed

docs/project/backlog/WP-30-ci-perf-followups.md

@@ -0,0 +1,63 @@
+# WP-30 — CI performance follow-ups
+
+Status: todo
+Phase: follow-on · CI/infra
+
+## Why
+
+Tier-1 CI speedups shipped in `708d4c2` (CodeQL off the PR path, Playwright/NuGet caches,
+`npm ci` flags) and the demo web image shrank to `node:24-slim`. These are the remaining
+options that were deliberately deferred — bigger changes, policy calls, or things that need
+Gitea runner-admin access. Revisit once there's an actual CI-timing breakdown to prioritise by,
+or when someone confirms act_runner access.
+
+Constraint carried over: **CI runs are not observable from the agent's environment** — validate
+any workflow edit by watching a real Gitea run; ship one change at a time so a red run is easy to
+bisect and revert. **The `docker compose` images are NOT used by CI** (CI = Gitea `ubuntu-latest`
+runner image, set on the act_runner host).
+
+## Read first
+
+- `.github/workflows/ci.yml` (current 6 jobs + the Tier-1 caches already in place).
+- The `ci-and-local-gate` note (agent memory) — CI traps + what's already done.
+- `docker-compose.yml` (demo images; `node:24-slim` done, dotnet SDK still full).
+
+## Candidate items (pick per impact once measured)
+
+1. **Skip `npm ci` install via a `node_modules` cache.** `actions/cache` on `node_modules`
+   keyed by `package-lock.json` hash; on a hit, `npm ci` is near-instant across the 4 npm jobs.
+   Bigger win than the existing npm-download cache, but a ~777 MB cache with a small staleness
+   risk — best if the runner's cache storage is local/fast. Medium effort, low-medium risk.
+2. **Smaller CI runner image.**
+   - _Real fix (needs runner admin):_ point act_runner's `ubuntu-latest` (or a new label) at a
+     smaller image with node + dotnet preinstalled. Biggest startup win. **Blocked on confirming
+     act_runner access.**
+   - _Repo-only partial:_ `container: node:24-slim` on the node-only jobs (`frontend`,
+     `storybook-a11y`), dropping `setup-node`. Doesn't help the node+dotnet jobs (`e2e`,
+     `api-client-drift`, `backend`) — a combined image would need building/pushing (new infra).
+     Risky on act_runner, unverifiable locally → stage alone, last.
+3. **Path-filtered jobs.** Skip `backend` on FE-only changes and vice-versa (workflow `paths:`
+   or `dorny/paths-filter`). Cuts compute on narrow PRs; watch required-check rules that expect
+   every job to report a status.
+4. **Split a fast `lint` job** (lint + format:check + check:tokens) for ~1 min fail-fast
+   feedback — only worth it once item 1 (node_modules cache) lands, else it duplicates `npm ci`.
+5. **Lean deployable backend image** (optional, not for the dev demo): multi-stage prod build on
+   `mcr.microsoft.com/dotnet/aspnet:10.0` (~220 MB) in a separate `docker-compose.prod.yml`. The
+   dev `docker-compose.yml` keeps the SDK image because `dotnet run` hot-reload needs it.
+
+## Acceptance criteria
+
+- [ ] Each chosen item verified GREEN on a real Gitea run (watched, since it's not observable
+      from the agent env), landed as its own revertable commit.
+- [ ] `npm run ci` still passes locally after any workflow/script change.
+
+## Out of scope
+
+- nx/turbo/remote build caching (overkill for this repo size).
+- Rewriting the dev compose into prod images (would lose bind-mount hot reload).
+
+## Risks
+
+- Unverifiable-from-agent workflow edits can only be confirmed on the runner — one change per
+  commit, revert on red.
+- act_runner-level changes depend on infra access this repo doesn't control.