test: timing budgets + CI hardening (artifact v3 pin, npm cache retry)

Closes three items from the outstanding e2e/CI gap list:

- Timing budgets: timings.measure() only ever recorded durations for the
  (still-unwired) Pushgateway export — nothing failed CI when a step got
  slow. Add e2e/timing-budgets.ts (expectWithinBudget + shared BUDGET_MS
  buckets) and wire it into every measure() call site across the suite.
  Mail-wait steps are deliberately left unbudgeted (external mail-trap
  delivery latency, not a code performance signal).

- actions/upload-artifact@v4 doesn't work against this Gitea/act runner's
  artifact backend — pin to v3 for the e2e failure-report upload.

- Shared act_runner npm cache has corrupted platform-native tarballs before
  (@next/swc-linux-x64-musl) and reds viewer-unit/admin-unit/e2e with no
  product bug involved. All three npm ci steps now retry once after
  `npm cache clean --force` on first failure.

Verified: full local suite green against DEV (37 passed, 6 skipped, no
budget assertion failures) before wiring into CI.

e2e/tests/viewer.write-gates.spec.ts

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { test, expect } from '../fixtures';
+import { BUDGET_MS, expectWithinBudget } from '../timing-budgets';
 
 /**
  * NextAuth (browser-session) write gates — `session.user.hasWriteAccess`
@@ -32,6 +33,7 @@ test.describe('viewer write gates (NextAuth, viewer) @smoke', () => {
         data: { firstName: 'Test', lastName: 'Viewer' },
       }),
     );
+    expectWithinBudget(timings, 'viewer_identify', BUDGET_MS.api);
     expect(res.status()).toBe(403);
     const body = await res.json();
     expect(body).toMatchObject({ error: expect.stringMatching(/write access/i) });
@@ -51,6 +53,7 @@ test.describe('viewer write gates (NextAuth, admin) @smoke', () => {
         data: { firstName: 'Test', lastName: 'Admin' },
       }),
     );
+    expectWithinBudget(timings, 'admin_identify', BUDGET_MS.api);
     // Admin clears the write-access gate; a nonexistent face id then 404s —
     // proves the gate didn't block a legitimate write-access user.
     expect(res.status()).toBe(404);