fix: pre-stage npm ci outside BuildKit sandbox

BuildKit sandbox has no network access for DNS resolution. Instead of
fighting it, run npm ci in a normal Woodpecker step (which has full
network), then COPY the whole frontend dir (including node_modules)
into the Docker build context. The Dockerfile just runs npm run build.

frontend/Dockerfile

@@ -1,9 +1,6 @@
-# Stage 1: Build
-# Base images: uses Harbor proxy cache in CI, falls back to Docker Hub externally
+# Stage 1: Build (node_modules pre-installed by CI step outside sandbox)
 FROM registry.celestium.life/dockerhub-cache/library/node:24-alpine AS build
 WORKDIR /app
-COPY package.json package-lock.json ./
-RUN npm ci
 COPY . .
 ARG VITE_QUERY_API_URL=""
 ARG VITE_SYMBOL_REGISTRY_URL=""