Run backend CI on PR updates and freeze frontend lockfile installs

ci-backend.yml had pull_request: types: [opened, reopened], which
excludes synchronize, so pushes to an open PR branch did not re-run
backend tests, lint or coverage and a broken follow-up commit could land
after the first green run. Drop the types filter so all default
pull_request events trigger the workflow.

ci-frontend.yml and ci-frontend-api.yml now install with
pnpm install --frozen-lockfile instead of pnpm i, matching release.yml
and preventing silent lockfile drift in CI.

.github/workflows/ci-backend.yml

@@ -13,7 +13,6 @@ on:
       - "!backend/scripts/**"
       - "!**.md"
   pull_request:
-    types: [opened, reopened]
     paths:
       - ".github/workflows/ci-backend.yml"
       - "backend/**"

.github/workflows/ci-frontend-api.yml

@@ -44,7 +44,7 @@ jobs:
           cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
         working-directory: ./frontend
 
       - name: Run type check
@@ -80,7 +80,7 @@ jobs:
           cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
         working-directory: ./frontend
 
       - name: Run linters
@@ -116,7 +116,7 @@ jobs:
           cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
         working-directory: ./frontend
 
       - name: Test & Coverage

.github/workflows/ci-frontend.yml

@@ -44,7 +44,7 @@ jobs:
           cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
         working-directory: ./frontend
 
       - name: Translations check
@@ -80,7 +80,7 @@ jobs:
           cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
         working-directory: ./frontend
 
       - name: Run type check
@@ -116,7 +116,7 @@ jobs:
           cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
         working-directory: ./frontend
 
       - name: Run linters
@@ -180,7 +180,7 @@ jobs:
           cache-dependency-path: frontend/pnpm-lock.yaml
 
       - name: Install dependencies
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
         working-directory: ./frontend
 
       - name: Test & Coverage