fix: pre-stage npm ci outside BuildKit sandbox

BuildKit sandbox has no network access for DNS resolution. Instead of
fighting it, run npm ci in a normal Woodpecker step (which has full
network), then COPY the whole frontend dir (including node_modules)
into the Docker build context. The Dockerfile just runs npm run build.

.woodpecker/build-3.yml

@@ -189,6 +189,20 @@ steps:
             memory: 2Gi
             cpu: 4000m
     depends_on: []
+  npm-install-dashboard:
+    image: registry.celestium.life/dockerhub-cache/library/node:24-alpine
+    commands:
+      - cd frontend && npm ci
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 1000m
+          limits:
+            memory: 2Gi
+            cpu: 4000m
+    depends_on: []
   build-dashboard:
     image: woodpeckerci/plugin-docker-buildx
     privileged: true
@@ -198,7 +212,6 @@ steps:
       buildx_image: registry.celestium.life/dockerhub-cache/moby/buildkit:buildx-stable-1
       add_host: registry.celestium.life:10.1.1.12
       buildx_flags: --driver-opt network=host
-      network: host
       insecure: true
       buildkit_config: |
         [registry."registry.celestium.life"]
@@ -231,7 +244,8 @@ steps:
           limits:
             memory: 2Gi
             cpu: 4000m
-    depends_on: []
+    depends_on:
+      - npm-install-dashboard
   build-superset:
     image: woodpeckerci/plugin-docker-buildx
     privileged: true

frontend/Dockerfile

@@ -1,9 +1,6 @@
-# Stage 1: Build
+# Stage 1: Build (node_modules pre-installed by CI step outside sandbox)
-# Base images: uses Harbor proxy cache in CI, falls back to Docker Hub externally
 FROM registry.celestium.life/dockerhub-cache/library/node:24-alpine AS build
 WORKDIR /app
-COPY package.json package-lock.json ./
-RUN npm ci
 COPY . .
 ARG VITE_QUERY_API_URL=""
 ARG VITE_SYMBOL_REGISTRY_URL=""