fix(ci): two stale-path bugs from the recent refactors

1. Backend test (test_arduino_cli_attinycore.py): the entrypoint script
   was renamed deploy/ → docker/ in commit b736aea but this test still
   pointed at the old path. Update the read_text() call + docstring.

2. Frontend CI (frontend-tests.yml): the cache key
   `frontend-${{ hashFiles('frontend/package-lock.json') }}` was tied to
   a file that has since been gitignored (commit eb9a3ec). hashFiles()
   on a missing file returns the same empty hash forever, so every CI
   run was restoring the same stale node_modules — including the
   symlinks to `file:../third-party/wokwi-elements` that existed before
   the npm migration in commit 531c337. On revalidation, npm tried to
   run wokwi-elements' `prepare` script (`husky install && npm run
   build`), which failed with "husky: not found".

   Drop the cache step entirely; lock files aren't committed so cache
   keys can't be made meaningful without overcomplication. Adds ~30s
   per CI run, but actually correct. Also pass --no-audit --no-fund
   to npm install for cleaner logs.

.github/workflows/frontend-tests.yml

@@ -24,17 +24,17 @@ jobs:
       - name: Clone wokwi-elements (for metadata regeneration only)
         run: git clone --depth=1 https://github.com/wokwi/wokwi-elements.git third-party/wokwi-elements
 
-      - name: Cache frontend node_modules
-        uses: actions/cache@v4
-        with:
-          path: frontend/node_modules
-          key: frontend-${{ hashFiles('frontend/package-lock.json') }}
+      # No node_modules cache. Lock files are gitignored (see .gitignore) so
+      # a cache key tied to package-lock.json never invalidates and ends up
+      # restoring stale links to old `file:` deps from previous commits
+      # (e.g. wokwi-elements pre-npm migration). Fresh install every run is
+      # ~30s slower but actually correct.
 
       - name: Install frontend dependencies
-        run: cd frontend && npm install
+        run: cd frontend && npm install --no-audit --no-fund --include=optional
 
       - name: Install root dev dependencies
-        run: npm install
+        run: npm install --no-audit --no-fund
 
       # Regenerate metadata and fail if committed JSON is stale. Catches PRs
       # that modify component-overrides.json without running generate:metadata.

test/backend/unit/test_arduino_cli_attinycore.py

@@ -14,7 +14,7 @@ Root cause: the frontend sends the FQBN
 ATTinyCore and arduino-cli didn't have the drazzy.com index URL configured.
 
 Fix lives in ``backend/app/services/arduino_cli.py`` (CORE_URLS +
-ON_DEMAND_CORES), ``deploy/entrypoint.sh`` (production image), and
+ON_DEMAND_CORES), ``docker/entrypoint.sh`` (production image), and
 ``backend/Dockerfile`` (dev image).
 
 These tests run pure-Python — no arduino-cli subprocess, no network. They
@@ -109,10 +109,10 @@ def test_core_id_for_fqbn_routes_attiny85():
 
 
 def test_entrypoint_installs_attinycore_in_production():
-    """deploy/entrypoint.sh must add the drazzy URL and `core install
+    """docker/entrypoint.sh must add the drazzy URL and `core install
     ATTinyCore:avr` so the standalone Docker image can compile ATtiny85
     sketches without the auto-install penalty on the first request."""
-    script = (_REPO / "deploy" / "entrypoint.sh").read_text(encoding="utf-8")
+    script = (_REPO / "docker" / "entrypoint.sh").read_text(encoding="utf-8")
     assert "drazzy.com/package_drazzy.com_index.json" in script, (
         "entrypoint.sh is missing the drazzy.com board-manager URL — first "
         "ATtiny85 compile will fail in the production Docker image."