test(ci): raise vitest testTimeout to 15s to stop CI-load flakes (#266)

Vitest's default per-test timeout is 5s. That's plenty for tests that
exercise pure functions or even simple JSX, but the heavier React
component trees we render under jsdom — MessagesView, GateView,
Wormhole contact flows — consistently measure 6-10s on GitHub Actions'
shared Node workers under load.

Concrete flake history that drove this bump (none were real product
bugs — all were CI load racing the 5s ceiling on findByText /
waitFor against React reconciliation):

  PR #226 messagesViewFirstContact > removes approved contact
  PR #237 (same)
  PR #261 (same)
  PR #262 (same) ← worst: fired on post-merge Docker Publish run,
                   prevented the AIS SPKI security fix's image from
                   being published to GHCR until PR #263 cumulatively
                   re-published it. Real security-fix-shipping risk.
  PR #264 fixed messagesViewFirstContact specifically with waitFor
  PR #265 messagesViewFirstContact > legacy handle-only addresses
                  AND gateCompatDecryptUx > browser-local gate runtime
                  AND failed on the rerun too — confirming the flake
                  class is broader than the one test we deflaked.

The deflake in PR #264 was too surgical — it addressed one specific
test out of a class of similarly-flaky CI-load-sensitive sites. This
PR addresses the root cause at the config layer instead of playing
whack-a-mole.

Why 15s specifically: 3x the default. Headroom for routine CI slowness
without masking real "test never settles" bugs (those would still
time out, just three rounds later). Individual tests can still pin
their own tighter timeout via the third arg to `it()`.

Also bumps hookTimeout to 15s — beforeEach/afterEach setup for the
same heavier component tests has the same CI-load sensitivity.

User-facing impact: zero. This is dev pipeline infrastructure. End
users never see test timeouts. The cost is theoretical: a buggy test
that genuinely never resolves now takes 15s to declare failure
instead of 5s. In practice that's negligible because the suite runs
once per CI invocation and tests don't usually deadlock.

Validation:
  Local full vitest run → 707 passed, 72 files, 10.36s wall clock
  (same speed as before — we only changed how long we WAIT for slow
   tests, not how fast tests actually run)

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

frontend/vitest.config.js

@@ -6,6 +6,35 @@ module.exports = defineConfig({
     environment: 'jsdom',
     globals: true,
     include: ['src/**/*.test.{ts,tsx}'],
+    // Default test timeout: 15s (up from vitest's 5s default).
+    //
+    // We render real React component trees under jsdom in many tests, and
+    // GitHub Actions' shared Node.js workers (specifically the
+    // "CI - Lint & Test / Frontend Tests & Build" job) consistently
+    // measure 6–10s for the heavier MessagesView / GateView / Wormhole
+    // contact flows under CI load. On a developer laptop those same tests
+    // settle in <1s, so the 5s default was tuned to local dev speed and
+    // not to CI runner speed.
+    //
+    // Concrete history that drove this bump (none of these were real
+    // product bugs — all were CI load racing the 5s ceiling on
+    // findByText / waitFor against React reconciliation):
+    //   PR #226, #237, #261, #262, #265 all flaked on
+    //     src/__tests__/mesh/messagesViewFirstContact.test.tsx
+    //     src/__tests__/mesh/gateCompatDecryptUx.test.tsx
+    //   PR #262's flake was the worst — it fired on the post-merge
+    //   Docker Publish run and prevented the AIS SPKI security fix's
+    //   image from being published to GHCR until the next PR
+    //   cumulatively re-published it.
+    //
+    // 15s is generous enough to absorb routine CI slowness without
+    // masking real "test never settles" bugs (those would still time
+    // out, just three rounds later). Individual tests can still pin
+    // their own tighter timeout via the third arg to `it()`.
+    testTimeout: 15000,
+    // Hook timeout follows test timeout — beforeEach/afterEach setup
+    // for the heavier component tests has the same CI-load sensitivity.
+    hookTimeout: 15000,
   },
   resolve: {
     alias: {