0aeec9c820
The ignore rule for package-lock.json had no leading slash, so it matched at any depth and kept frontend/package-lock.json out of the repository. The frontend CI job meanwhile installs with npm ci and caches against that exact path, neither of which can work when the file is absent from a clean checkout. The rule is now anchored to the repository root and the lockfile is tracked.