feat(ci): assert gzip transfer sizes against ADR-0017 budgets

Angular CLI's `budgets` only compare RAW sizes — there's no native
gzip-mode budget. ADR-0017 specifies thresholds in gzip-transfer
terms (initial bundle ≤ 300 KB gzip, any lazy chunk ≤ 100 KB gzip,
total stylesheet ≤ 150 KB gzip), so the project.json values today
are an approximate raw-size translation. The follow-up flagged in
ADR-0017's confirmation list — a CI check that asserts the actual
gzipped transfer size — lands here.

`scripts/check-gzip-budgets.mjs`:

- Parses Angular's emitted index.html to separate initial assets
  (anything referenced via src=/href=) from lazy chunks (the rest).
- Gzips every JS / CSS file at level 9 — what most HTTP servers
  serve for static assets — and reports a per-file + per-bucket
  size table.
- Compares against the ADR-0017 budgets and exits non-zero on any
  breach. Plain Node, no deps; ~120 lines.

Wired through:

- `pnpm ci:gzip-budgets` invokes the script with the default dist
  path (`dist/apps/portal-shell/browser`).
- `ci:perf` chains build → gzip check → Lighthouse, so a
  budget breach short-circuits before Lighthouse even runs (saves
  several minutes on a failing PR).

ADR-0017 §Confirmation updated: the previous "future follow-up
will add a CI check" line is replaced by a description of how the
script works, with a link to it.

Verified locally on the production build:
- Initial JS total: 92.88 KB / 300 KB budget ✓
- Lazy chunks largest: 1.38 KB / 100 KB per-chunk budget ✓
- CSS total: 3.35 KB / 150 KB budget ✓

package.json

@@ -8,7 +8,8 @@
     "ci:check": "pnpm exec nx affected -t format:check lint test build",
     "ci:audit": "pnpm audit --audit-level=moderate",
     "ci:commits": "pnpm exec commitlint --from ${COMMIT_LINT_FROM:-origin/main} --to HEAD --verbose",
-    "ci:perf": "pnpm exec nx build portal-shell --configuration=production && pnpm exec lhci autorun --config=./lighthouserc.js"
+    "ci:gzip-budgets": "node scripts/check-gzip-budgets.mjs",
+    "ci:perf": "pnpm exec nx build portal-shell --configuration=production && pnpm ci:gzip-budgets && pnpm exec lhci autorun --config=./lighthouserc.js"
   },
   "private": true,
   "lint-staged": {