ci(release): cache npm, Go build cache, and Wails CLI

Release runs were fully cold every time: ~13s npm install, ~39s full cgo/WebKit compile, and ~34s rebuilding the Wails CLI from source on each tag. Now that the runner cache backend is reachable again, persist all three across runs. Expected total drops from ~3.5 min toward ~2.5 min with apt as the remaining floor.

- Set up Node: cache npm keyed on frontend/package-lock.json, so the npm install inside wails build stops fetching cold
- New Cache Go build cache step: setup-go only persists modules (GOMODCACHE); this persists compiled packages (GOCACHE) with a go.sum-hashed key plus a version-prefix restore-key fallback, turning the WebKit compile incremental from the second run on
- Wails CLI: split install into cache (key wails-v2.15.0-Linux, bump with the version pin), conditional go install on miss, and an unconditional PATH step so cache hits still land on PATH

First run after this still compiles cold (it saves); the payoff shows from the second run on. Verify with the throwaway-tag loop and compare Build Linux binary times.

.gitea/workflows/release.yml

@@ -80,10 +80,27 @@ jobs:
           go-version: '1.25'
           cache-dependency-path: go.sum
 
+      - name: Cache Go build cache
+        uses: actions/cache@v4
+        with:
+          # setup-go only caches modules (GOMODCACHE). This caches compiled
+          # packages (GOCACHE) so the cgo/WebKit compile goes incremental.
+          # restore-keys gives a close cache instead of a cold one when
+          # go.sum changes. First run after adding this still compiles cold
+          # (it saves); the payoff shows from the second run on.
+          path: ~/.cache/go-build
+          key: go-build-1.25-${{ runner.os }}-${{ hashFiles('go.sum') }}
+          restore-keys: |
+            go-build-1.25-${{ runner.os }}-
+
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
           node-version: '20'
+          # Caches npm's download cache keyed on the frontend lockfile, so
+          # the `npm install` inside `wails build` stops fetching cold.
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
 
       - name: Install Wails Linux build dependencies
         run: |
@@ -94,11 +111,23 @@ jobs:
             libgtk-3-dev libwebkit2gtk-4.1-dev \
             jq
 
+      - name: Cache Wails CLI
+        uses: actions/cache@v4
+        id: wails-cli
+        with:
+          # The compiled CLI binary. Bump the key whenever the @version pin
+          # below changes, or the old CLI will be silently reused.
+          path: ~/go/bin/wails
+          key: wails-v2.15.0-${{ runner.os }}
+
       - name: Install Wails CLI
+        if: steps.wails-cli.outputs.cache-hit != 'true'
         run: |
           set -euo pipefail
           go install github.com/wailsapp/wails/v2/cmd/wails@v2.15.0
-          echo "${HOME}/go/bin" >> "${GITHUB_PATH}"
+
+      - name: Add Go bin to PATH
+        run: echo "${HOME}/go/bin" >> "${GITHUB_PATH}"
 
       - name: Write environment.go from secrets
         env: