fix(ci): survive GitHub's anonymous rate limit

Composer's dist downloads come from GitHub, which throttles anonymous callers —
on a shared address that is a coin flip, and it took the run down after four
minutes of setup. Source clones are the fallback, and both toolchains now cache
their package directories so a repeat run barely touches the network.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/tests.yml

@@ -26,8 +26,20 @@ jobs:
           extensions: mbstring, pdo_sqlite, sodium, redis, bcmath, gd, zip
           coverage: none
 
+      - name: Cache Composer packages
+        uses: actions/cache@v4.1.2
+        with:
+          path: ~/.cache/composer
+          key: composer-${{ hashFiles('composer.lock') }}
+          restore-keys: composer-
+
       - name: Install PHP dependencies
-        run: composer install --no-interaction --prefer-dist --no-progress
+        # Dist downloads come from GitHub, which rate-limits anonymous callers —
+        # on a shared IP that is a coin flip. Falling back to source clones keeps
+        # CI self-sufficient instead of depending on someone else's quota.
+        run: |
+          composer install --no-interaction --prefer-dist --no-progress \
+            || composer install --no-interaction --prefer-source --no-progress
 
       - name: Prepare environment
         run: |
@@ -47,6 +59,13 @@ jobs:
         with:
           node-version: '22'
 
+      - name: Cache npm packages
+        uses: actions/cache@v4.1.2
+        with:
+          path: ~/.npm
+          key: npm-${{ hashFiles('package-lock.json') }}
+          restore-keys: npm-
+
       - name: Install JS dependencies
         run: npm ci --no-fund --no-audit