Make the frontend build and validate it in CI

[koppor]

🤖

• What kind of change does this PR introduce?

CI + build fix. It makes the frontend build again and adds that build to the Check workflow.

• What is the current behavior?

./gradlew check (the only CI gate) compiles the backend and runs its empty test suite — it never touches the frontend. And the frontend has not actually been buildable for a long time: its source is an Angular 4 app (HttpModule from @angular/http, NgbModule.forRoot(), rxjs/add imports, core-js/es6/* polyfills, the ngx-uploader 2 API, and a CLI-1.x .angular-cli.json workspace with no angular.json), but Dependabot bumped the version numbers in package.json / npm-shrinkwrap.json up to @angular/cli 12 / @angular/core 10 with no source migration. The result is an incoherent manifest that cannot build:

• @angular/cli 12 requires angular.json; the repo only has .angular-cli.json (CLI ≤ 5 format).
• @angular/* packages straddled majors 4 / 7 / 10.
• core-js 3 removed the es6/* paths polyfills.ts imports.
• ngx-uploader 4 renamed the API the source still calls (NgUploaderModule / NgUploaderOptions).

Because CI never built the frontend, breaking Dependabot bumps for the frontend (the only ecosystem Dependabot updates here, besides GitHub Actions) could sail through unnoticed.

• What is the new behavior (if this is a feature change)?

  1. The frontend builds again. Dependencies are reconciled to the last hand-authored, source-matching versions (the manifest at 001a3de), with two toolchain adjustments needed to install/build on the Node 8 ABI the app targets: @angular/cli → 1.4.10 and typescript → 2.4.2. The docs-site tooling (wintersmith / wintersmith-sassy) is dropped — its transitive node-sass 3.x has no Node 8 prebuilt and aborted npm install, and it is unrelated to ng build. The stale yarn.lock is removed (the build uses npm; npm-shrinkwrap.json is the lockfile that is actually consumed).
  2. CI builds the frontend. The Check workflow is split into a backend job (the existing ./gradlew check, unchanged) and a frontend job that runs npm ci + npm run build on Node 8.

Verified locally: a clean npm ci + npm run build on Node 8.17 produces dist/ with zero compile errors.

• Other information:

  • This intentionally lowers many version numbers. Those versions never existed in a building frontend — they were mechanical Dependabot bumps on top of un-migrated source. Restoring a coherent, compiling baseline is the prerequisite for CI to be meaningful. With a green build now gating them, Dependabot can re-propose the framework-independent security bumps (jquery, lodash, underscore, etc.) one at a time and CI will catch the ones that break.
  • Relation to automerge: the frontend job only protects automerge once it is a required status check in branch protection on main. Right now main is unprotected, so this job runs but does not yet block a merge — configuring branch protection to require backend and frontend is the follow-up that actually makes Dependabot automerge safe.
  • UI tests: none are added here. There are no spec files in the tree; this PR only guarantees the app compiles. Real ng test / e2e coverage is a separate, larger effort.