Fix Windows frontend preparation with isolated installs

[dovvnloading]

Problem

pm ci modified the live frontend/node_modules directory. When a running Vite process held Rolldown's native Windows binding, npm failed with EPERM and left the install partially removed.

Fix

• stage frontend build inputs beside the source tree
• run npm ci and the production build only in the isolated staging tree
• atomically publish the generated dist bundle
• clean staging on success and failure
• add regression coverage for live-install preservation

Verification

• python -m ruff check backend tests tools main.py`n- python -m pytest -q (374 passed, 1 skipped)
• reproduced python main.py --build-frontend while Vite held the native binding; build passed