test: timing budgets + CI hardening (artifact v3 pin, npm cache retry)

Closes three items from the outstanding e2e/CI gap list:

- Timing budgets: timings.measure() only ever recorded durations for the
  (still-unwired) Pushgateway export — nothing failed CI when a step got
  slow. Add e2e/timing-budgets.ts (expectWithinBudget + shared BUDGET_MS
  buckets) and wire it into every measure() call site across the suite.
  Mail-wait steps are deliberately left unbudgeted (external mail-trap
  delivery latency, not a code performance signal).

- actions/upload-artifact@v4 doesn't work against this Gitea/act runner's
  artifact backend — pin to v3 for the e2e failure-report upload.

- Shared act_runner npm cache has corrupted platform-native tarballs before
  (@next/swc-linux-x64-musl) and reds viewer-unit/admin-unit/e2e with no
  product bug involved. All three npm ci steps now retry once after
  `npm cache clean --force` on first failure.

Verified: full local suite green against DEV (37 passed, 6 skipped, no
budget assertion failures) before wiring into CI.

.gitea/workflows/ci.yml

@@ -90,7 +90,15 @@ jobs:
           cache-dependency-path: viewer-frontend/package-lock.json
 
       - name: Install deps
-        run: npm ci
+        # act_runner's shared npm cache has corrupted platform-native tarballs
+        # before (@next/swc-linux-x64-musl) and reds this job with no product
+        # bug involved — clear the cache and retry once before giving up.
+        run: |
+          npm ci || {
+            echo "npm ci failed, clearing npm cache and retrying once..."
+            npm cache clean --force
+            npm ci
+          }
 
       - name: Run Vitest
         run: npm test
@@ -115,7 +123,14 @@ jobs:
           cache-dependency-path: admin-frontend/package-lock.json
 
       - name: Install deps
-        run: npm ci
+        # Same shared act_runner npm cache corruption as viewer-unit — retry
+        # once with a clean cache rather than redding CI for an infra flake.
+        run: |
+          npm ci || {
+            echo "npm ci failed, clearing npm cache and retrying once..."
+            npm cache clean --force
+            npm ci
+          }
 
       - name: Run Vitest
         run: npm test
@@ -143,7 +158,13 @@ jobs:
           git config --global url."https://oauth2:${{ secrets.PLAYKIT_GIT_TOKEN }}@git.levkin.ca/".insteadOf "https://git.levkin.ca/"
 
       - name: Install e2e deps
-        run: npm ci
+        # Same shared act_runner npm cache corruption as viewer-unit/admin-unit.
+        run: |
+          npm ci || {
+            echo "npm ci failed, clearing npm cache and retrying once..."
+            npm cache clean --force
+            npm ci
+          }
 
       - name: Install Chromium
         run: npx playwright install --with-deps chromium
@@ -184,7 +205,9 @@ jobs:
 
       - name: Upload report
         if: failure()
-        uses: actions/upload-artifact@v4
+        # v4 breaks on this Gitea/act runner (act_runner's artifact API doesn't
+        # speak v4's backend protocol) — pin v3.
+        uses: actions/upload-artifact@v3
         with:
           name: playwright-report
           path: |