修复：统一主题切换并升级依赖与验证流程

.gitea/workflows/frontend.yml

@@ -0,0 +1,35 @@
+# 仅做前端验证，不包含发布、服务器登录或生产凭证。
+name: 前端验证
+on:
+  push:
+  pull_request:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: 获取源码
+        uses: https://github.com/actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: 准备 Node.js
+        uses: https://github.com/actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+      - name: 安装锁定依赖
+        run: npm ci
+      - name: 安装测试浏览器
+        run: npx playwright install --with-deps chromium
+      - name: 检查源码并构建
+        run: |
+          npm run check
+          npm run build
+      - name: 验收真实生产构建
+        run: |
+          task_chrome_path="$(node --input-type=module -e 'import { chromium } from "playwright"; process.stdout.write(chromium.executablePath())')"
+          CHROME_PATH="$task_chrome_path" npm test
+      # deepmerge 尚无上游修复版本；低危传播项保留在审计输出，不通过降级框架隐藏。
+      - name: 阻止中危及以上依赖风险
+        run: npm audit --audit-level=moderate