fix(ci): move grpc-tools to optionalDependencies (revert NODE_OPTIONS attempt)

The NODE_OPTIONS=--use-system-ca workaround merged in #199 did not
clear the failure — the same TLS-chain rejection still trips the
runner. Either the runner's OS CA store also lacks the missing
intermediate, or `--use-system-ca` does not propagate down to the
node-fetch@2 used by node-pre-gyp. Without runner shell access the
exact reason is not worth investigating.

Different angle: grpc-tools is never invoked in CI. The protoc
binary it downloads is only used by `pnpm run grpc:codegen`, which
runs on a developer's machine when a proto file changes. The
generated TypeScript stubs in apps/portal-bff/src/grpc/gen/ are
committed (per ADR-0024 §"Sub-decision 3 — vendored protos"), so
CI only needs to type-check them — protoc is dead weight there.

Move grpc-tools from devDependencies to optionalDependencies. Per
pnpm semantics, an optional dependency whose install (including
postinstall) fails is logged as a warning and the overall install
continues. On the runner: postinstall still fails on TLS, pnpm
emits a warning, ci:check proceeds. On a developer machine: TLS
validates, postinstall runs, protoc binary lands, `pnpm grpc:codegen`
works exactly as before. No dev-side friction; no workflow env
vars to maintain.

Reverts the workflow `env:` blocks added in #199 — they did not
help and adding noise to the workflow YAML for a non-working
workaround is worse than removing it.

.gitea/workflows/ci.yml

@@ -11,18 +11,6 @@ on:
   push:
     branches: [main]
 
-# Node 24's bundled CA set does not include every intermediate the
-# self-hosted runner's network path serves (the precompiled-binary
-# CDN behind grpc-tools is the first surface where this surfaced).
-# `--use-system-ca` tells Node to consult the OS CA store in
-# addition to its bundled set — supported since Node 22 and the
-# documented Node-team fix for exactly this class of TLS-chain
-# rejection. The runner image (`catthehacker/ubuntu:act-22.04` per
-# ADR-0015) carries the standard Ubuntu `ca-certificates` bundle,
-# which validates the impacted chains.
-env:
-  NODE_OPTIONS: --use-system-ca
-
 jobs:
   check:
     runs-on: [self-hosted, on-prem]

.gitea/workflows/docs-site.yml

@@ -28,13 +28,6 @@ on:
       - 'pnpm-lock.yaml'
       - '.gitea/workflows/docs-site.yml'
 
-# See `.gitea/workflows/ci.yml` for the rationale — Node 24's
-# bundled CA set rejects some chains the runner's OS trust store
-# validates, and `--use-system-ca` (Node ≥ 22) tells Node to
-# consult the OS CA bundle alongside its own.
-env:
-  NODE_OPTIONS: --use-system-ca
-
 jobs:
   build:
     runs-on: [self-hosted, on-prem]

package.json

@@ -111,7 +111,6 @@
     "eslint": "^9.8.0",
     "eslint-config-prettier": "^10.0.0",
     "eslint-plugin-playwright": "^1.6.2",
-    "grpc-tools": "^1.13.0",
     "husky": "^9.1.7",
     "jest": "^30.0.2",
     "jest-environment-node": "^30.0.2",
@@ -196,5 +195,8 @@
     "pino-http": "^11.0.0",
     "reflect-metadata": "^0.2.0",
     "rxjs": "~7.8.0"
+  },
+  "optionalDependencies": {
+    "grpc-tools": "^1.13.0"
   }
 }

pnpm-lock.yaml

@@ -356,9 +356,6 @@ importers:
       eslint-plugin-playwright:
         specifier: ^1.6.2
         version: 1.8.3(eslint@9.39.4(jiti@2.7.0))
-      grpc-tools:
-        specifier: ^1.13.0
-        version: 1.13.1(encoding@0.1.13)
       husky:
         specifier: ^9.1.7
         version: 9.1.7
@@ -434,6 +431,10 @@ importers:
       webpack-cli:
         specifier: ^5.1.4
         version: 5.1.4(webpack@5.106.2)
+    optionalDependencies:
+      grpc-tools:
+        specifier: ^1.13.0
+        version: 1.13.1(encoding@0.1.13)
 
   libs/shared/tokens:
     dependencies:
@@ -13769,6 +13770,7 @@ snapshots:
     transitivePeerDependencies:
       - encoding
       - supports-color
+    optional: true
 
   '@mermaid-js/mermaid-mindmap@9.3.0':
     dependencies:
@@ -17052,7 +17054,8 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
-  abbrev@3.0.1: {}
+  abbrev@3.0.1:
+    optional: true
 
   abbrev@4.0.0: {}
 
@@ -19242,6 +19245,7 @@ snapshots:
     transitivePeerDependencies:
       - encoding
       - supports-color
+    optional: true
 
   hachure-fill@0.5.2: {}
 
@@ -20863,6 +20867,7 @@ snapshots:
   nopt@8.1.0:
     dependencies:
       abbrev: 3.0.1
+    optional: true
 
   nopt@9.0.0:
     dependencies: