fix(ci): disable broken pnpm cache on actions/setup-node

`act_runner`'s built-in GitHub-Actions-cache server binds inside the
runner container on the compose-defined `apf-portal-act-runners`
bridge. Jobs spawned via the mounted Docker socket come up on
Docker's default `bridge` network and cannot reach it. Every job
opting into `cache: 'pnpm'` therefore eats ~2 min ETIMEDOUT on
restore at the start and another ~2 min on save at the end — for
zero cache hits. Across the five jobs that's ~20 min wasted per CI
run.

Drop `cache: 'pnpm'` from all five jobs. `pnpm install
--frozen-lockfile` is fast enough on the warm store inside the job
container that the cache layer is currently no value-add anyway.

Document the proper fix (cross-container networking / fixed-port
cache binding) in infra/README.md so a future infra spike can
re-enable caching cleanly.

.gitea/workflows/ci.yml

@@ -2,6 +2,15 @@
 # Thin YAML — orchestration lives in package.json scripts (ci:check,
 # ci:audit, ci:commits, ci:perf) and Nx targets. Any change to gate
 # behaviour belongs in those scripts, not in this file.
+#
+# `cache: 'pnpm'` is intentionally NOT enabled on actions/setup-node
+# below: act_runner's built-in GitHub-Actions-cache server is bound on
+# the runner container and is unreachable from job containers (which
+# run on Docker's default network, not the runners' compose network).
+# Each request burns a ~2 min ETIMEDOUT on restore + another on save,
+# for zero hit rate. Once the runner network/cache config is fixed
+# (tracked in infra/README.md "Cache server"), re-add `cache: 'pnpm'`
+# here.
 
 name: CI
 
@@ -41,7 +50,6 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
-          cache: 'pnpm'
       - run: pnpm install --frozen-lockfile
       - run: pnpm ci:check
 
@@ -53,7 +61,6 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
-          cache: 'pnpm'
       - run: pnpm install --frozen-lockfile
       - run: pnpm ci:audit
       # Dependency vulnerability scan (binary tool, invoked via official
@@ -82,7 +89,6 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
-          cache: 'pnpm'
       - run: pnpm install --frozen-lockfile
       - run: COMMIT_LINT_FROM=origin/main pnpm ci:commits
 
@@ -100,7 +106,6 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
-          cache: 'pnpm'
       - run: pnpm install --frozen-lockfile
       - run: pnpm ci:perf
       - uses: actions/upload-artifact@v4
@@ -118,7 +123,6 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version-file: '.nvmrc'
-          cache: 'pnpm'
       - run: pnpm install --frozen-lockfile
       # Placeholder until the e2e a11y suite (axe-core via Playwright,
       # per ADR-0016) is wired with the first real screens. The job