Harden Gitea CI resource usage

.gitea/workflows/ci.yaml

@@ -12,47 +12,10 @@ on:
     branches: [main]
 
 jobs:
-  backend:
-    name: Backend (.NET)
-    runs-on: linux
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup .NET SDK
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: '8.0.x'
-
-      - name: Restore
-        run: dotnet restore Backend/Backend.csproj
-
-      - name: Build
-        run: dotnet build Backend/Backend.csproj --no-restore --configuration Release
-
-  frontend:
-    name: Frontend (Vue/TS)
-    runs-on: linux
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '24'
-
-      - name: Install dependencies
-        run: npm ci
-        working-directory: frontend
-
-      - name: Build
-        run: npm run build
-        working-directory: frontend
-
-  hygiene:
-    name: Repository Hygiene
-    runs-on: linux
+  verify:
+    name: Build, Typecheck & Hygiene
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -82,3 +45,21 @@ jobs:
             echo "$hits"
             exit 1
           fi
+
+      - name: Backend build
+        run: |
+          set -euo pipefail
+          docker run --rm \
+            -v "${{ gitea.workspace }}:/workspace" \
+            -w /workspace \
+            mcr.microsoft.com/dotnet/sdk:8.0-alpine \
+            sh -lc 'dotnet restore Backend/Backend.csproj && dotnet build Backend/Backend.csproj --no-restore --configuration Release'
+
+      - name: Frontend build
+        run: |
+          set -euo pipefail
+          docker run --rm \
+            -v "${{ gitea.workspace }}:/workspace" \
+            -w /workspace/frontend \
+            node:24-alpine \
+            sh -lc 'npm ci && npm run build'

.gitea/workflows/deploy.yaml

@@ -27,6 +27,7 @@ jobs:
   deploy:
     name: Deploy to award.noveria.net
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: |
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'workflow_run' &&