fix(ci): track frontend lockfile for reproducible installs

The blanket package-lock.json gitignore rule meant the frontend lockfile was never committed, so every release installed whatever the registry handed it (silent transitive drift) and setup-node npm caching failed outright with unable to cache dependencies. Scope the ignore rule to the repo root (/package-lock.json; no root package.json exists) and commit the freshly updated frontend lockfile: all deps at max in-range versions (autoprefixer 10.5.6 -> 10.6.0), majors intentionally deferred to the v3 frontend refresh. Verified with a green vite build before committing.

.gitignore

@@ -26,7 +26,9 @@ build/bin
 node_modules
 frontend/dist
 package.json.md5
-package-lock.json
+# Root-level lockfile only: the frontend lockfile IS tracked so CI installs
+# are reproducible and setup-node's npm cache has something to hash.
+/package-lock.json
 .idea
 .env
 environment.go