fix(ci): build the frontend before any Go typecheck

main.go embeds frontend/dist, so lint, test and bindings-check all fail
on a fresh clone until pnpm build has run. Invisible locally because
anyone who has started the app has a dist/ lying around, and the
container prototype missed it because both job scripts shared one
mounted directory, so job 1 consumed a dist/ that job 2's dev-headless
had built on an earlier run.

.gitea/workflows/ci.yml

@@ -113,6 +113,16 @@ jobs:
           pnpm install --frozen-lockfile
           npx playwright install --with-deps chromium
 
+      # main.go embeds the built frontend (`//go:embed all:frontend/dist`),
+      # so *every* Go typecheck needs it to exist first — lint, test and
+      # bindings-check all fail with "pattern all:frontend/dist: no
+      # matching files found" on a fresh clone.  This never bites locally
+      # because anyone who has run the app once has a dist/ lying around,
+      # which is exactly why CI has to do it explicitly.
+      - name: Build the frontend
+        working-directory: /src/frontend
+        run: pnpm build
+
       # `make lint` and `make test` each run all three build
       # configurations (app / indexbuild / dev) with matching tag sets.
       - name: Lint