ci: cache pip downloads and collapse install into one pip call

Two wins:
  * actions/setup-python's built-in pip cache, keyed on the two
    pyproject.toml files, turns the 20+ transitive dep downloads into
    a single tarball restore on cache hit.
  * One ``pip install -e ./core -e ./server[dev]`` call instead of
    two — lets pip's resolver run once over the combined graph and
    skips the second invocation's overhead.

Also dropped ``pip install --upgrade pip``: the runner image already
ships a recent pip, and the upgrade ran once per CI job for no gain.

.gitea/workflows/build.yml

@@ -17,14 +17,16 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: "3.12"
+          cache: "pip"
+          cache-dependency-path: |
+            packages/core/pyproject.toml
+            packages/server/pyproject.toml
 
       - name: Install core + server + dev deps (in venv)
         run: |
           python -m venv .venv
           . .venv/bin/activate
-          python -m pip install --upgrade pip
-          python -m pip install -e ./packages/core
-          python -m pip install -e "./packages/server[dev]"
+          python -m pip install -e ./packages/core -e "./packages/server[dev]"
 
       - name: Run pytest (server)
         run: |

.gitea/workflows/release.yml

@@ -17,13 +17,15 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
+          cache: "pip"
+          cache-dependency-path: |
+            packages/core/pyproject.toml
+            packages/server/pyproject.toml
       - name: Install + test (in venv, isolated from hosted tool cache)
         run: |
           python -m venv .venv
           . .venv/bin/activate
-          python -m pip install --upgrade pip
-          python -m pip install -e ./packages/core
-          python -m pip install -e "./packages/server[dev]"
+          python -m pip install -e ./packages/core -e "./packages/server[dev]"
           cd packages/server && pytest -q --maxfail=1
 
   release: