perf(api,web,db): refactor and optimize for enterprise readiness

- Add missing @@index([userId]) on Account and Session models (auth query perf)
- Batch holiday-auto-import to eliminate N+1 query pattern (O(n) → O(1))
- Reduce SessionProvider refetchInterval from 5min to 15min
- Fix Cache-Control catch-all to stop blocking static asset caching
- Decompose assistant-tools.ts (2,562 → 809 lines) into callers, helpers, access-control modules
- Add @next/bundle-analyzer for data-driven bundle optimization
- Add @react-pdf/renderer to optimizePackageImports
- Add safety caps (take limits) on unbounded findMany queries

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/db/prisma/schema.prisma

@@ -282,6 +282,7 @@ model Account {
 
   user              User    @relation(fields: [userId], references: [id], onDelete: Cascade)
 
+  @@index([userId])
   @@unique([provider, providerAccountId])
   @@map("accounts")
 }
@@ -293,6 +294,7 @@ model Session {
   expires      DateTime
   user         User     @relation(fields: [userId], references: [id], onDelete: Cascade)
 
+  @@index([userId])
   @@map("sessions")
 }
 
@@ -938,6 +940,7 @@ model Project {
   color             String?           // Hex color for timeline display, e.g. "#3b82f6"
   coverImageUrl     String?  @db.Text // Base64 data-URL for project cover art
   coverFocusY       Int      @default(50) // Vertical focus point 0-100 (% from top)
+  coverAiGenerated  Boolean  @default(false) // EGAI 4.3.1.3 — true when cover was AI-generated
 
   // staffingReqs: StaffingRequirement[]
   staffingReqs    Json           @db.JsonB @default("[]")