ci(cd): turbo-кэш, гейты typecheck/lint, таймауты, non-root образ

- .turbo в actions/cache (пересборки shared/db переиспользуются между прогонами)
- typecheck в web/api джобах, lint бэкенда в api-джобе
- убран пустой turbo test --filter=web (в web нет тестов)
- timeout-minutes на все джобы
- Dockerfile: USER node + --chown; прекомпрессия статики gzip+brotli на этапе
  сборки (Traefik не сжимает); compose: chown 1000:1000 data в инструкции

.gitea/workflows/cd.yaml

@@ -25,6 +25,7 @@ jobs:
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master') &&
       needs.quality.result == 'success'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: write
       packages: write

.gitea/workflows/quality.yaml

@@ -33,6 +33,7 @@ permissions:
 jobs:
   changes:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
       web:    ${{ steps.detect.outputs.web }}
       api:    ${{ steps.detect.outputs.api }}
@@ -148,6 +149,7 @@ jobs:
     needs: [changes]
     if: needs.changes.outputs.web == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -163,6 +165,7 @@ jobs:
           path: |
             ${{ env.PNPM_STORE_DIR }}
             ${{ env.COREPACK_HOME }}
+            .turbo
             node_modules
             apps/web/node_modules
             apps/api/node_modules
@@ -172,20 +175,21 @@ jobs:
           key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
           restore-keys: |
             pnpm-${{ runner.os }}-
-      - name: pnpm install, lint, test, build
+      - name: pnpm install, lint, typecheck, build
         env:
           PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
         run: |
           set -euxo pipefail
           sh scripts/ci/pnpm-ci.sh
           pnpm --filter web lint
-          pnpm exec turbo run test --filter=web
+          pnpm exec turbo run typecheck --filter=web
           pnpm exec turbo run build --filter=web
 
   api:
     needs: [changes]
     if: needs.changes.outputs.api == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -201,6 +205,7 @@ jobs:
           path: |
             ${{ env.PNPM_STORE_DIR }}
             ${{ env.COREPACK_HOME }}
+            .turbo
             node_modules
             apps/web/node_modules
             apps/api/node_modules
@@ -210,18 +215,21 @@ jobs:
           key: pnpm-${{ runner.os }}-${{ steps.pnpm-hash.outputs.key }}
           restore-keys: |
             pnpm-${{ runner.os }}-
-      - name: pnpm install, test, build
+      - name: pnpm install, lint, test, typecheck, build
         env:
           PNPM_CACHE_HIT: ${{ steps.pnpm-cache.outputs.cache-hit }}
         run: |
           set -euxo pipefail
           sh scripts/ci/pnpm-ci.sh
+          pnpm exec turbo run lint --filter=@authportal/api --filter=@authportal/db --filter=@authportal/shared
           pnpm exec turbo run test --filter=@authportal/api
+          pnpm exec turbo run typecheck --filter=@authportal/api
           pnpm exec turbo run build --filter=@authportal/api
 
   commitlint:
     if: inputs.is_pull_request
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
@@ -262,6 +270,7 @@ jobs:
     needs: [changes]
     if: inputs.is_pull_request && needs.changes.outputs.docker == 'true'
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1