perf: optimize app-wide startup and route loading [6/6]

[Anthony Cintron (prbatero)]

Summary

Extend the project layer-loading stack with app-wide startup, publishing, map, and route optimizations. Stable authenticated startup now avoids management-plane reconciliation and ACL writes, while route-specific work overlaps wherever dependencies allow.

Changes

• Add a read-only session bootstrap with object-ID-first ACL matching and principal/ACL role intersection.
• Harden legacy user reads and updates with active-caller, self-or-admin, and strong identity checks.
• Add a bounded five-second single-flight Published Datasets cache with ETags, conditional responses, and mutation invalidation.
• Deduplicate visible-tab polling and clear stale requests and errors safely.
• Overlap route imports, Azure Maps assets, dashboard/catalog data, validation data, layer-form data, and Interactive Labeler metadata/artifacts.
• Defer Maps on Create/Edit Image Layer until the catalog drawer opens.
• Add retryable loading failures, required artifact cancellation, route-owned map readiness markers, and lazy Help media.
• Add fail-closed desktop/mobile cold/warm direct/in-app performance matrices with sanitized output.

Testing

• Core library: 601 passed.
• HTTP API: 72 passed.
• Queue Functions: 6 passed.
• UI: 148 passed.
• Black, isort, and Flake8 passed for feature-owned Python files.
• ESLint passed for all 38 changed UI files; the production Vite build transformed 2,419 modules in 431 ms.
• Both benchmark scripts passed Node syntax checks.
• git diff --check, VS Code diagnostics, Markdown links/tables, and feature-only detect-secrets passed.
• Repository-wide UI lint still reports pre-existing errors in untouched components.

Stack

• Depends on: perf(ui): lazy-load routes and Azure Maps assets [5/5] #189.
• This PR: app-wide follow-up, based on prbatero/feat/perf-ui-route-loading.
• Independent security fix: fix(api): reject client-supplied workflow state #184 remains separate.

Open Gates

• Do not deploy this session-bootstrap path while the Function endpoint accepts public traffic and trusts x-ms-client-principal. Restrict ingress to trusted SWA/APIM traffic or validate a signed identity first.
• The authenticated Dev1 route matrix has not run because external Playwright auth state and representative fixture IDs were not supplied.
• The one-to-three-second route target is therefore not yet claimed as achieved.
• ADR-0005 remains proposed and the rollout stays blocked until these gates close.