perf(docker): switch builder stages to npm ci (#822)

Both frontend-builder and backend-builder ran `npm install` even
though `prod-deps` already used `npm ci`. `npm install` walks the
dep graph and silently rewrites the lockfile when there is drift,
which costs build time and lets a stale lockfile slip into a release
image. `npm ci` enforces the lockfile, fails fast on drift, and skips
the resolution work since the dep tree is fully described by the
lockfile.

Both lockfiles are in sync (verified with `npm install
--package-lock-only` reporting "up to date"), so the change is a
pure tightening with no behavior delta in the happy path.

Dockerfile

@@ -13,7 +13,7 @@ WORKDIR /app/frontend
 COPY frontend/package*.json frontend/.npmrc ./
 RUN npm config set fetch-retry-maxtimeout 120000 && \
     npm config set fetch-retries 5 && \
-    npm install
+    npm ci
 
 COPY frontend/ ./
 # vite.config.ts reads the root package.json for the app version
@@ -31,7 +31,7 @@ RUN apk add --no-cache python3 make g++
 COPY backend/package*.json backend/.npmrc ./
 RUN npm config set fetch-retry-maxtimeout 120000 && \
     npm config set fetch-retries 5 && \
-    npm install
+    npm ci
 
 COPY backend/ ./
 # prebuild hook (generate-version.js) reads the root package.json for the app version