feat: block CI on the frontend type check

svelte-check is clean, so it gates like the rest. eslint still reports without
failing, now for two findings rather than 87: both are the unsanitized book
description, written up in TODO.md.

.gitea/workflows/ci.yml

@@ -2,10 +2,11 @@ name: ci
 
 # Formatting, linting, types and tests on every push and pull request.
 #
-# Blocking: the checks that are clean today — ruff format, ruff check, prettier, pytest.
-# Non-blocking: eslint and svelte-check, which still report 87 and 30 pre-existing errors.
-# Those need real code changes rather than a formatter, so they report without failing the
-# build; drop the `continue-on-error` line from a step once its count reaches zero.
+# Blocking: ruff format, ruff check, pytest, prettier and svelte-check.
+# Non-blocking: eslint, which reports two `{@html}` XSS findings in collapsible-text.svelte.
+# Those are a real vulnerability rather than a lint nit — book descriptions from EPUB files
+# are not sanitized — and fixing them is a backend change. Drop the `continue-on-error` once
+# that lands, at which point every check blocks.
 #
 # The release workflow runs the blocking half again before it publishes anything.
 
@@ -77,4 +78,3 @@ jobs:
 
       - name: Types
         run: pnpm check
-        continue-on-error: true

.gitea/workflows/release.yml

@@ -50,12 +50,13 @@ jobs:
         with:
           node-version: 24
 
-      - name: Frontend format
+      - name: Frontend format and types
         working-directory: frontend
         run: |
           corepack enable
           pnpm install --frozen-lockfile
           pnpm exec prettier --check .
+          pnpm check
 
   build:
     needs: quality