#613 Speed up client-build: hoist ng build out of Docker

[bracyw]

Changes

Mirrors the #610 scylla idea (build once native, avoid QEMU on real work) but goes further — collapses the client workflow to a single job. ng build runs once on an amd64 runner, then one buildx push produces the multi-arch manifest directly.

• Single build-and-push job: checkout, setup-node, npm ci, npm run build:production, setup-qemu, setup-buildx, login, one buildx call with platforms: linux/amd64,linux/arm64
• New angular-client/Dockerfile.prebuilt: nginx:alpine base, no Build stage, COPYs the prebuilt browser/ artifact along with nginx.conf, env.prod.js, and entrypoint.sh
• angular-client/Dockerfile is untouched so build-check.yml and compose still build from source

Notes

• Deviates from the ticket AC in two deliberate ways:
  • AC calls for three jobs (build-client → build-image matrix → merge). Started there, then realized the per-arch Docker work is just apk add gettext plus static COPYs — native runners bought nothing. The ng build hoist is what actually saves the QEMU time. Collapsed to one job to drop pointless artifact upload/download and the imagetools merge step.
  • AC calls for cache: "npm" on setup-node. ng build dominates build-client wall time and the cache burns runner storage on a hash that turns over every lockfile change. Happy to add either back if a reviewer wants strict AC parity.
• Workflow is workflow_dispatch only, so timings come from manually triggering the workflow on this branch. Will fill them in here once the first run completes.
• Out of scope per the ticket: enabling .angular/cache in CI as a follow-up.

Test Cases

• Lint and prettier pass on the angular-client tree
• No merge conflicts against develop
• CI run pending: confirm the job produces a multi-arch manifest that pulls and runs on both amd64 and arm64

Checklist

• All commits are tagged with the ticket number
• No linting errors / newline at end of file warnings
• All code follows repository-configured prettier formatting
• No merge conflicts
• All checks passing
• Remove any non-applicable sections of this template
• Assign the PR to yourself
• No package-lock.json changes (unless dependencies have changed)
• Request reviewers & ping on Slack
• PR is linked to the ticket (fill in the closes line below)

Closes #613