CI: enforce license check and ignore private root package

.gitea/workflows/ci.yml

@@ -236,11 +236,12 @@ jobs:
       - name: Check npm licenses
         run: |
           if [ -f "package.json" ]; then
-            license-checker --onlyAllow 'MIT;Apache-2.0;BSD-3-Clause;ISC;BSD-2-Clause' || true
+            npm ci
+            # Exclude the repo itself (private=true packages are treated as UNLICENSED by license-checker).
+            license-checker --excludePrivatePackages --onlyAllow 'MIT;Apache-2.0;BSD-3-Clause;ISC;BSD-2-Clause'
           else
             echo "No package.json found, skipping license check"
           fi
-        continue-on-error: true
 
   vault-check:
     needs: skip-ci-check