The frontend deps bump regenerated ui/package-lock.json with the
@fortawesome/fontawesome-free tarball resolved from npm.fontawesome.com
(per the developer's scoped ~/.npmrc), which requires auth. CI has no
FontAwesome token, so `npm ci` failed with E401.
The free package is also published to the public registry with an
identical tarball/integrity, so pin @fortawesome to registry.npmjs.org
via ui/.npmrc and repoint the lockfile. Verified `npm ci` + build now
succeed with no token.
