test: timing budgets + CI hardening (artifact v3 pin, npm cache retry)

Closes three items from the outstanding e2e/CI gap list:

- Timing budgets: timings.measure() only ever recorded durations for the
  (still-unwired) Pushgateway export — nothing failed CI when a step got
  slow. Add e2e/timing-budgets.ts (expectWithinBudget + shared BUDGET_MS
  buckets) and wire it into every measure() call site across the suite.
  Mail-wait steps are deliberately left unbudgeted (external mail-trap
  delivery latency, not a code performance signal).

- actions/upload-artifact@v4 doesn't work against this Gitea/act runner's
  artifact backend — pin to v3 for the e2e failure-report upload.

- Shared act_runner npm cache has corrupted platform-native tarballs before
  (@next/swc-linux-x64-musl) and reds viewer-unit/admin-unit/e2e with no
  product bug involved. All three npm ci steps now retry once after
  `npm cache clean --force` on first failure.

Verified: full local suite green against DEV (37 passed, 6 skipped, no
budget assertion failures) before wiring into CI.

e2e/tests/api.role-permissions.spec.ts

@@ -1,5 +1,6 @@
 import type { ApiClient } from '@levkin/playkit';
 import { test, expect } from '../fixtures';
+import { BUDGET_MS, expectWithinBudget } from '../timing-budgets';
 
 /**
  * FastAPI role-permission write gates: `admin`-role users pass
@@ -28,11 +29,14 @@ test.describe('role permissions @smoke', () => {
     test.skip(!ready, 'E2E_API_* and E2E_API_VIEWER_* required');
 
     const adminToken = await timings.measure('login_admin', () => login(api, adminUser, adminPass));
+    expectWithinBudget(timings, 'login_admin', BUDGET_MS.api);
     const viewerToken = await timings.measure('login_viewer', () => login(api, viewerUser, viewerPass));
+    expectWithinBudget(timings, 'login_viewer', BUDGET_MS.api);
 
     const viewerRes = await timings.measure('viewer_users', () =>
       api.withAuthBearer(viewerToken).get('/api/v1/users', { expectedStatus: 403 }),
     );
+    expectWithinBudget(timings, 'viewer_users', BUDGET_MS.api);
     expect(viewerRes.status).toBe(403);
     expect(viewerRes.data).toMatchObject({ detail: expect.stringMatching(/admin/i) });
 
@@ -41,6 +45,7 @@ test.describe('role permissions @smoke', () => {
         expectedStatus: 200,
       }),
     );
+    expectWithinBudget(timings, 'admin_users', BUDGET_MS.api);
     expect(adminRes.status).toBe(200);
     expect(Array.isArray(adminRes.data.items)).toBe(true);
   });
@@ -52,16 +57,20 @@ test.describe('role permissions @smoke', () => {
     test.skip(!ready, 'E2E_API_* and E2E_API_VIEWER_* required');
 
     const adminToken = await timings.measure('login_admin', () => login(api, adminUser, adminPass));
+    expectWithinBudget(timings, 'login_admin', BUDGET_MS.api);
     const viewerToken = await timings.measure('login_viewer', () => login(api, viewerUser, viewerPass));
+    expectWithinBudget(timings, 'login_viewer', BUDGET_MS.api);
 
     const viewerRes = await timings.measure('viewer_role_perms', () =>
       api.withAuthBearer(viewerToken).get('/api/v1/role-permissions', { expectedStatus: 403 }),
     );
+    expectWithinBudget(timings, 'viewer_role_perms', BUDGET_MS.api);
     expect(viewerRes.status).toBe(403);
 
     const adminRes = await timings.measure('admin_role_perms', () =>
       api.withAuthBearer(adminToken).get('/api/v1/role-permissions', { expectedStatus: 200 }),
     );
+    expectWithinBudget(timings, 'admin_role_perms', BUDGET_MS.api);
     expect(adminRes.status).toBe(200);
     expect(adminRes.data).toHaveProperty('permissions');
   });
@@ -73,7 +82,9 @@ test.describe('role permissions @smoke', () => {
     test.skip(!ready, 'E2E_API_* and E2E_API_VIEWER_* required');
 
     const adminToken = await timings.measure('login_admin', () => login(api, adminUser, adminPass));
+    expectWithinBudget(timings, 'login_admin', BUDGET_MS.api);
     const viewerToken = await timings.measure('login_viewer', () => login(api, viewerUser, viewerPass));
+    expectWithinBudget(timings, 'login_viewer', BUDGET_MS.api);
 
     // Use a photo id that cannot exist — proves the write *gate*, not deletion.
     // The admin dependency runs before the handler body, so this never touches
@@ -86,6 +97,7 @@ test.describe('role permissions @smoke', () => {
         expectedStatus: 403,
       }),
     );
+    expectWithinBudget(timings, 'viewer_bulk_delete', BUDGET_MS.api);
     expect(viewerRes.status).toBe(403);
 
     const adminRes = await timings.measure('admin_bulk_delete', () =>
@@ -94,6 +106,7 @@ test.describe('role permissions @smoke', () => {
         expectedStatus: 200,
       }),
     );
+    expectWithinBudget(timings, 'admin_bulk_delete', BUDGET_MS.api);
     expect(adminRes.status).toBe(200);
     expect(adminRes.data).toMatchObject({ deleted_count: 0, missing_photo_ids: [nonExistentId] });
   });