perf(frontend): add gzipped first-load JS budget check and CI

[eleven-smg]

What

Adds the missing measurement and enforcement layer for the frontend JS bundle-size target in #273.

The bundle analyzer (npm run analyze, next-bundle-analyzer) and route-based splitChunks code-splitting are already in next.config.js. What was missing is anything that actually measures the < 200KB gzipped first-load target or enforces a budget in CI — this PR adds exactly that, non-destructively.

Changes

• frontend/scripts/check-bundle-budget.mjs — dependency-free Node script that reads the Next build manifests (build-manifest.json / app-build-manifest.json), gzips first-load JS per route, prints a per-route table, and compares the largest route to the budget.
• frontend/performance-budget.json — budget config (200 KB, enforce: false, ignored error routes).
• frontend/package.json — adds a bundle-budget script.
• frontend/docs/BUNDLE_BUDGET.md — usage, config, and CI docs.
• .github/workflows/bundle-budget.yml — builds the frontend and runs the check on frontend/** PRs.

Notes

• Report-only by default (enforce: false), mirroring the existing report-only CI jobs (e.g. the secret-scan workflow): the budget table appears in the job log without breaking the build. Flip enforce to true once routes are under budget to make it a blocking gate.
• No application code changed and no existing config touched destructively — only additive tooling.

Closes #273