perf(api,web,db): refactor and optimize for enterprise readiness

- Add missing @@index([userId]) on Account and Session models (auth query perf)
- Batch holiday-auto-import to eliminate N+1 query pattern (O(n) → O(1))
- Reduce SessionProvider refetchInterval from 5min to 15min
- Fix Cache-Control catch-all to stop blocking static asset caching
- Decompose assistant-tools.ts (2,562 → 809 lines) into callers, helpers, access-control modules
- Add @next/bundle-analyzer for data-driven bundle optimization
- Add @react-pdf/renderer to optimizePackageImports
- Add safety caps (take limits) on unbounded findMany queries

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/web/next.config.ts

@@ -7,7 +7,13 @@ const nextConfig: NextConfig = {
   outputFileTracingRoot: path.resolve(__dirname, "../.."),
   devIndicators: false,
   experimental: {
-    optimizePackageImports: ["recharts", "date-fns", "framer-motion", "@capakraken/shared"],
+    optimizePackageImports: [
+      "recharts",
+      "date-fns",
+      "framer-motion",
+      "@capakraken/shared",
+      "@react-pdf/renderer",
+    ],
   },
   transpilePackages: [
     "@capakraken/api",
@@ -60,8 +66,8 @@ const nextConfig: NextConfig = {
         ],
       },
       {
-        // Catch-all for error pages and any remaining routes
-        source: "/:path*",
+        // Catch-all for error pages and remaining routes (exclude static assets)
+        source: "/((?!_next/static|_next/image|favicon.ico).*)",
         headers: [
           { key: "Cache-Control", value: "no-store, no-cache, must-revalidate" },
           { key: "Pragma", value: "no-cache" },
@@ -88,7 +94,13 @@ const nextConfig: NextConfig = {
 // Only wrap with Sentry in production — the worker.js crash in dev mode
 // (vendor-chunks/lib/worker.js MODULE_NOT_FOUND) makes the dev server unstable
 // Sentry only in production — dynamic import avoids side effects in dev
+// Bundle analyzer — run with ANALYZE=true to inspect client/server chunks
 let exportedConfig: NextConfig = nextConfig;
+if (process.env.ANALYZE === "true") {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const withBundleAnalyzer = require("@next/bundle-analyzer")({ enabled: true });
+  exportedConfig = withBundleAnalyzer(exportedConfig);
+}
 if (process.env.NODE_ENV === "production") {
   try {
     // eslint-disable-next-line @typescript-eslint/no-require-imports

apps/web/package.json

@@ -49,6 +49,7 @@
     "zod": "^3.23.8"
   },
   "devDependencies": {
+    "@next/bundle-analyzer": "^15.5.15",
     "@axe-core/playwright": "^4.11.1",
     "@capakraken/eslint-config": "workspace:*",
     "@capakraken/tsconfig": "workspace:*",

apps/web/src/lib/trpc/provider.tsx

@@ -89,7 +89,7 @@ export function TRPCProvider({ children }: { children: React.ReactNode }) {
   );
 
   return (
-    <SessionProvider refetchInterval={5 * 60}>
+    <SessionProvider refetchInterval={15 * 60}>
       <trpc.Provider client={trpcClient} queryClient={queryClient}>
         <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
       </trpc.Provider>