CI misses frontend tests, dependency audit, caching #101

What's wrong

A few more gaps in CI, all smaller than #99:

• web-admin (vitest) and ui-tests (Playwright) are never run in CI, so frontend changes are untested there.
• There is no dependency audit (cargo audit or osv-scanner), so known advisories in dependencies go unnoticed.
• There is no cargo cache, so every run rebuilds all dependencies from scratch.
• There is no concurrency setting, so old runs keep going when you push again.

Why it matters

Frontend and dependency problems are only found by hand, and slow, redundant runs waste CI time and make people less likely to wait for results.

How it could look

• A job that runs npm ci && npm test in web-admin, and the Playwright tests in ui-tests.
• osv-scanner (or cargo audit) as a scheduled or per-PR job.
• Swatinem/rust-cache (or actions/cache) for ~/.cargo and target.
• concurrency: { group: ${{ github.workflow }}-${{ github.ref }}, cancel-in-progress: true } at the top of the workflow.

Probably best split into small PRs, one per item.