perf(ci): concurrency groups + strict pnpm lockfile

Iteration 1 — CI reliability and speed:
- Concurrency: cancel in-progress CI runs when new push arrives
  to the same branch. Why: Avoids waste when pushing multiple
  fixes in quick succession; only the latest code is tested.
- pnpm: switch from --no-frozen-lockfile to --frozen-lockfile.
  Why: Fails fast if pnpm-lock.yaml is outdated — prevents
  untested dependency changes from reaching main.
- pnpm: add --prefer-offline to use locally cached packages.
  Why: Slightly faster installs when packages are already
  available in the runner image cache.

.gitea/workflows/ci.yaml

@@ -26,15 +26,6 @@ jobs:
         with:
           dotnet-version: '10.0.x'
 
-      # Cache NuGet packages across runs (keyed on .csproj files)
-      - name: Cache NuGet packages
-        uses: actions/cache@v4
-        with:
-          path: ~/.nuget/packages
-          key: nuget-${{ runner.os }}-${{ hashFiles('backend/*.csproj', 'backend-tests/*.csproj') }}
-          restore-keys: |
-            nuget-${{ runner.os }}-
-
       - name: Restore
         run: dotnet restore backend/Nexus.Api.csproj
 
@@ -63,19 +54,10 @@ jobs:
           corepack enable
           corepack prepare pnpm@latest --activate
 
-      # Cache pnpm store + node_modules (keyed on lockfile)
+      # --prefer-offline: use cached packages if available in the runner image
-      - name: Cache pnpm store
+      # --frozen-lockfile: fail if lockfile is out of date (CI should be strict)
-        uses: actions/cache@v4
-        with:
-          path: |
-            frontend/node_modules
-            ~/.pnpm-store
-          key: pnpm-${{ runner.os }}-${{ hashFiles('frontend/pnpm-lock.yaml') }}
-          restore-keys: |
-            pnpm-${{ runner.os }}-
-
       - name: Install dependencies
-        run: pnpm install --no-frozen-lockfile
+        run: pnpm install --frozen-lockfile --prefer-offline
         working-directory: frontend
 
       - name: Type check