fix(ci): move grpc-tools to optionalDependencies (revert NODE_OPTIONS attempt)

The NODE_OPTIONS=--use-system-ca workaround merged in #199 did not
clear the failure — the same TLS-chain rejection still trips the
runner. Either the runner's OS CA store also lacks the missing
intermediate, or `--use-system-ca` does not propagate down to the
node-fetch@2 used by node-pre-gyp. Without runner shell access the
exact reason is not worth investigating.

Different angle: grpc-tools is never invoked in CI. The protoc
binary it downloads is only used by `pnpm run grpc:codegen`, which
runs on a developer's machine when a proto file changes. The
generated TypeScript stubs in apps/portal-bff/src/grpc/gen/ are
committed (per ADR-0024 §"Sub-decision 3 — vendored protos"), so
CI only needs to type-check them — protoc is dead weight there.

Move grpc-tools from devDependencies to optionalDependencies. Per
pnpm semantics, an optional dependency whose install (including
postinstall) fails is logged as a warning and the overall install
continues. On the runner: postinstall still fails on TLS, pnpm
emits a warning, ci:check proceeds. On a developer machine: TLS
validates, postinstall runs, protoc binary lands, `pnpm grpc:codegen`
works exactly as before. No dev-side friction; no workflow env
vars to maintain.

Reverts the workflow `env:` blocks added in #199 — they did not
help and adding noise to the workflow YAML for a non-working
workaround is worse than removing it.

pnpm-lock.yaml

@@ -356,9 +356,6 @@ importers:
       eslint-plugin-playwright:
         specifier: ^1.6.2
         version: 1.8.3(eslint@9.39.4(jiti@2.7.0))
-      grpc-tools:
-        specifier: ^1.13.0
-        version: 1.13.1(encoding@0.1.13)
       husky:
         specifier: ^9.1.7
         version: 9.1.7
@@ -434,6 +431,10 @@ importers:
       webpack-cli:
         specifier: ^5.1.4
         version: 5.1.4(webpack@5.106.2)
+    optionalDependencies:
+      grpc-tools:
+        specifier: ^1.13.0
+        version: 1.13.1(encoding@0.1.13)
 
   libs/shared/tokens:
     dependencies:
@@ -13769,6 +13770,7 @@ snapshots:
     transitivePeerDependencies:
       - encoding
       - supports-color
+    optional: true
 
   '@mermaid-js/mermaid-mindmap@9.3.0':
     dependencies:
@@ -17052,7 +17054,8 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
-  abbrev@3.0.1: {}
+  abbrev@3.0.1:
+    optional: true
 
   abbrev@4.0.0: {}
 
@@ -19242,6 +19245,7 @@ snapshots:
     transitivePeerDependencies:
       - encoding
       - supports-color
+    optional: true
 
   hachure-fill@0.5.2: {}
 
@@ -20863,6 +20867,7 @@ snapshots:
   nopt@8.1.0:
     dependencies:
       abbrev: 3.0.1
+    optional: true
 
   nopt@9.0.0:
     dependencies: