test: timing budgets + CI hardening (artifact v3 pin, npm cache retry)

Closes three items from the outstanding e2e/CI gap list:

- Timing budgets: timings.measure() only ever recorded durations for the
  (still-unwired) Pushgateway export — nothing failed CI when a step got
  slow. Add e2e/timing-budgets.ts (expectWithinBudget + shared BUDGET_MS
  buckets) and wire it into every measure() call site across the suite.
  Mail-wait steps are deliberately left unbudgeted (external mail-trap
  delivery latency, not a code performance signal).

- actions/upload-artifact@v4 doesn't work against this Gitea/act runner's
  artifact backend — pin to v3 for the e2e failure-report upload.

- Shared act_runner npm cache has corrupted platform-native tarballs before
  (@next/swc-linux-x64-musl) and reds viewer-unit/admin-unit/e2e with no
  product bug involved. All three npm ci steps now retry once after
  `npm cache clean --force` on first failure.

Verified: full local suite green against DEV (37 passed, 6 skipped, no
budget assertion failures) before wiring into CI.

e2e/tests/auth.signout.spec.ts

@@ -3,6 +3,7 @@ import {
   waitForUrlHost,
 } from '@levkin/playkit';
 import { test, expect } from '../fixtures';
+import { BUDGET_MS, expectWithinBudget } from '../timing-budgets';
 
 test.describe('auth @smoke', () => {
   test('login page loads on public host', async ({
@@ -14,6 +15,7 @@ test.describe('auth @smoke', () => {
     assertPublicHost(playkitConfig.baseUrl);
 
     await timings.measure('login_page', () => loginPage.openLogin());
+    expectWithinBudget(timings, 'login_page', BUDGET_MS.uiAction);
 
     await expect(page.getByRole('heading', { name: /Sign in/i })).toBeVisible();
     await expect(page.locator('#email')).toBeVisible();
@@ -42,10 +44,12 @@ test.describe('auth @smoke', () => {
       await page.waitForURL((url) => !url.pathname.includes('/login'), { timeout: 30_000 });
       await page.getByLabel('Account menu').waitFor({ state: 'visible', timeout: 30_000 });
     });
+    expectWithinBudget(timings, 'login', BUDGET_MS.uiLogin);
 
     await waitForUrlHost(page, playkitConfig.expectedHost);
 
     await timings.measure('sign_out', () => accountMenu.signOut());
+    expectWithinBudget(timings, 'sign_out', BUDGET_MS.uiAction);
 
     // After sign-out, NextAuth must redirect to the public host — never 10.x.
     await waitForUrlHost(page, playkitConfig.expectedHost);