ci: stop waiting on npm's 503-ing audit endpoint during npm ci

The frontend job on be623c1b spent 357 of its 407 seconds inside `npm ci`; the
build it exists to run (tsc + vite) took 13. The install itself was never the
problem — the audit request npm makes after installing was:

    npm warn audit 503 Service Unavailable -
      POST https://registry.npmjs.org/-/npm/v1/security/advisories/bulk
    npm notice This endpoint is being retired. Use the bulk advisory endpoint instead.

npm retries that call before printing "added 380 packages in 6m". Measured
locally against the same lock file with the same warm cache:

    npm ci                                                 61s
    npm ci --no-audit --no-fund                             4s
    NPM_CONFIG_AUDIT=false NPM_CONFIG_FUND=false npm ci      4s

This is the same slowdown that timed out `test / Python 3.11` on 8555a05a, so
splitting the frontend into its own job treated the symptom; this is the cause.

Turning the audit off costs no coverage:

- `npm ci` exits 0 no matter what the audit reports — verified by running it
  against this tree, not assumed from the docs. It never gated anything.
- The endpoint currently returns no advisories at all, so the call is buying
  zero information even when it does answer.
- Dependabot watches the same dependency tree and is the channel that actually
  reports: the 7 open alerts on this repo (fast-uri, @xmldom/xmldom,
  browserslist, postcss-selector-parser) all come from it, none from here.

Set as workflow-level env rather than flags on four separate `npm ci` lines, so
any npm invocation added later inherits it. It applies to CI only — a
developer's own `npm ci` still audits once npmjs.com recovers.

.github/workflows/desktop-windows.yml

@@ -21,6 +21,24 @@ on:
 permissions:
   contents: read
 
+# `npm ci` runs a security audit after installing and blocks on the response.
+# npmjs.com's advisory endpoint is currently answering 503 (it prints "This
+# endpoint is being retired"), so npm retries it: on 2026-09-04 that turned a
+# 4s install into a 6m one and timed the CI job out mid-install. Measured on one
+# machine, one lock file, one warm cache:
+#
+#   npm ci                                    61s
+#   npm ci --no-audit --no-fund                4s
+#   NPM_CONFIG_AUDIT=false NPM_CONFIG_FUND=false npm ci    4s
+#
+# Nothing is lost. `npm ci` exits 0 whatever the audit says (verified directly),
+# the endpoint returns no advisories at all right now, and Dependabot already
+# watches this same tree — it is what reported the 7 open npm alerts. This is CI
+# only; a developer's `npm ci` still audits when the endpoint recovers.
+env:
+  NPM_CONFIG_AUDIT: "false"
+  NPM_CONFIG_FUND: "false"
+
 jobs:
   package:
     # GTK is extracted as a checksum-pinned archive rather than executed as a

.github/workflows/test.yml

@@ -10,6 +10,24 @@ on:
   # verdict on main short of pushing an empty commit.
   workflow_dispatch:
 
+# `npm ci` runs a security audit after installing and blocks on the response.
+# npmjs.com's advisory endpoint is currently answering 503 (it prints "This
+# endpoint is being retired"), so npm retries it: on 2026-09-04 that turned a
+# 4s install into a 6m one and timed the CI job out mid-install. Measured on one
+# machine, one lock file, one warm cache:
+#
+#   npm ci                                    61s
+#   npm ci --no-audit --no-fund                4s
+#   NPM_CONFIG_AUDIT=false NPM_CONFIG_FUND=false npm ci    4s
+#
+# Nothing is lost. `npm ci` exits 0 whatever the audit says (verified directly),
+# the endpoint returns no advisories at all right now, and Dependabot already
+# watches this same tree — it is what reported the 7 open npm alerts. This is CI
+# only; a developer's `npm ci` still audits when the endpoint recovers.
+env:
+  NPM_CONFIG_AUDIT: "false"
+  NPM_CONFIG_FUND: "false"
+
 jobs:
   hash-lock:
     name: Hash lock / ${{ matrix.name }}