perf(api,web,db): refactor and optimize for enterprise readiness

- Add missing @@index([userId]) on Account and Session models (auth query perf)
- Batch holiday-auto-import to eliminate N+1 query pattern (O(n) → O(1))
- Reduce SessionProvider refetchInterval from 5min to 15min
- Fix Cache-Control catch-all to stop blocking static asset caching
- Decompose assistant-tools.ts (2,562 → 809 lines) into callers, helpers, access-control modules
- Add @next/bundle-analyzer for data-driven bundle optimization
- Add @react-pdf/renderer to optimizePackageImports
- Add safety caps (take limits) on unbounded findMany queries

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/api/src/__tests__/assistant-tools-broadcast-send.test.ts

@@ -39,6 +39,7 @@ describe("assistant broadcast send tool", () => {
 
     expect(db.user.findMany).toHaveBeenCalledWith({
       select: { id: true },
+      take: 10_000,
     });
     expect(create).not.toHaveBeenCalled();
     expect(JSON.parse(result.content)).toEqual({
@@ -80,6 +81,7 @@ describe("assistant broadcast send tool", () => {
 
     expect(db.user.findMany).toHaveBeenCalledWith({
       select: { id: true },
+      take: 10_000,
     });
     expect(create).toHaveBeenCalledWith({
       data: expect.objectContaining({