feat: add reusable Node check workflow

npm ci, then npm run <script> for each entry of the scripts input.
PR gate for frontends so Renovate can automerge npm updates.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.gitea/workflows/node-check.yaml

@@ -0,0 +1,57 @@
+name: Node Check (Reusable)
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        description: "Node.js version"
+        required: false
+        default: "22"
+        type: string
+      working-directory:
+        description: "Directory containing package.json and package-lock.json (relative to repo root)"
+        required: false
+        default: "."
+        type: string
+      scripts:
+        description: "Space-separated npm scripts, run in order with `npm run <script>` after `npm ci`, e.g. \"check test build\""
+        required: true
+        type: string
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    env:
+      SCRIPTS: ${{ inputs.scripts }}
+      CI: "true"
+
+    defaults:
+      run:
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ inputs.node-version }}
+          package-manager-cache: false
+
+      - name: Install
+        run: npm ci
+
+      - name: Run scripts
+        run: |
+          read -ra LIST <<< "$SCRIPTS"
+          if [ "${#LIST[@]}" -eq 0 ]; then
+            echo "::error::input 'scripts' is empty"
+            exit 1
+          fi
+          for s in "${LIST[@]}"; do
+            echo "::group::npm run $s"
+            npm run "$s"
+            echo "::endgroup::"
+          done