ci: dedup frontend job, drop frontend-ci.yml duplicate

frontend-ci.yml was structurally broken (npm ci in apps/web with no
lockfile at that path — workspace lockfile lives at repo root) and
duplicated lint/tsc/build/test from ci.yml. Folded its useful checks
(OpenAPI types-sync, bundle-size gate, npm audit) into ci.yml's frontend
job and removed the duplicate workflow.

Why:
- Cuts CI time by ~50% on frontend (no double-run).
- Avoids burning two runner slots per push for the same code.
- Eliminates the broken `npm ci` in apps/web that produced silent
  fallbacks.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -106,6 +106,13 @@ jobs:
             - name: Install dependencies
               run: npm ci
 
+            # Prevents drift between veza-backend-api/openapi.yaml and
+            # apps/web/src/types/generated/. Regenerates then fails if
+            # git diff is non-empty.
+            - name: Check OpenAPI types in sync
+              run: bash scripts/check-types-sync.sh
+              working-directory: apps/web
+
             - name: Lint
               # NOTE: --max-warnings is temporarily raised to 2000 while the
               # team resorbs the ESLint warning backlog (1167 at last count,
@@ -122,6 +129,13 @@ jobs:
               run: npm run build
               working-directory: apps/web
 
+            - name: Bundle size gate
+              run: node scripts/check-bundle-size.mjs
+              working-directory: apps/web
+
+            - name: Audit dependencies
+              run: npm audit --audit-level=critical
+
             - name: Unit tests
               run: npx vitest run --reporter=verbose
               working-directory: apps/web

.github/workflows/frontend-ci.yml

@@ -1,64 +0,0 @@
-name: Frontend CI
-
-on:
-    push:
-        paths:
-            - "apps/web/**"
-            - "veza-backend-api/openapi.yaml"
-            - "veza-backend-api/docs/swagger.yaml"
-            - ".github/workflows/frontend-ci.yml"
-    pull_request:
-        paths:
-            - "apps/web/**"
-            - "veza-backend-api/openapi.yaml"
-            - "veza-backend-api/docs/swagger.yaml"
-            - ".github/workflows/frontend-ci.yml"
-
-env:
-    GIT_SSL_NO_VERIFY: "true"
-    NODE_TLS_REJECT_UNAUTHORIZED: "0"
-
-jobs:
-    test:
-        runs-on: ubuntu-latest
-
-        defaults:
-            run:
-                working-directory: apps/web
-
-        steps:
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-            - name: Set up Node
-              uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
-              with:
-                  node-version: "20"
-                  cache: "npm"
-                  cache-dependency-path: apps/web/package-lock.json
-
-            - name: Install dependencies
-              run: npm ci
-
-            # v1.0.8 OpenAPI Phase 0 — prevents drift between
-            # veza-backend-api/openapi.yaml and apps/web/src/types/generated/.
-            # check-types-sync.sh regenerates then fails if git diff is non-empty.
-            - name: Check OpenAPI types in sync
-              run: bash scripts/check-types-sync.sh
-
-            - name: Lint
-              run: npm run lint
-
-            - name: TypeScript check
-              run: npx tsc --noEmit
-
-            - name: Build
-              run: npm run build
-
-            - name: Bundle size gate
-              run: node scripts/check-bundle-size.mjs
-
-            - name: Audit dependencies
-              run: npm audit --audit-level=critical
-
-            - name: Run tests
-              run: npm run test -- --run