chore: patch deps, CSP style nonces, otplib 13, and PR CI

Co-authored-by: Cursor <[email protected]>

.gitea/workflows/ci.yaml

@@ -0,0 +1,38 @@
+name: CI
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  check:
+    runs-on: shell
+    steps:
+      - name: Typecheck, lint, and test
+        run: |
+          set -e
+          WORK="$(mktemp -d /var/tmp/epicnext-ci.XXXXXX)"
+          cleanup() { rm -rf "${WORK}"; }
+          trap cleanup EXIT
+
+          echo "--- CI checks (${WORK}) ---"
+          git clone --depth 50 \
+            /docker/gitea/gitea/git/repositories/remco/epicnext-cms.git \
+            "${WORK}"
+          cd "${WORK}"
+
+          REF="${{ gitea.sha }}"
+          if [ -z "${REF}" ]; then
+            echo "ERROR: missing gitea.sha" >&2
+            exit 1
+          fi
+          git fetch --depth 50 origin "${REF}"
+          git checkout -f "${REF}"
+
+          export SKIP_ENV_VALIDATION=1
+          pnpm install --frozen-lockfile
+          pnpm prisma:generate
+          pnpm biome:lint
+          pnpm typecheck
+          pnpm test
+          echo "--- CI checks passed ---"