perf: optimize app-wide startup and route loading [6/6]

[Anthony Cintron (prbatero)]

Summary

Extend the project layer-loading stack with app-wide startup, publishing, map, and route optimizations. This follow-up also resolves observed duplicate loading indicators, slow standard-labeling startup, and route contention from abandoned Dashboard work.

Changes

• Add a read-only session bootstrap with object-ID-first ACL matching and principal/ACL role intersection.
• Add bounded Published Datasets caching, ETags, conditional polling, and mutation invalidation.
• Add GetLabelingWorkspace, returning one allowlisted target layer plus current labels and project labeling configuration.
• Add cached GetActiveJobs, replacing Dashboard N-way GetProjectDetails fan-out with one compact conditional request.
• Render Dashboard as soon as required data resolves; load Model Catalog and Ongoing Jobs independently.
• Propagate AbortSignal through route GETs and abort Dashboard, jobs, and map-owned work on navigation.
• Suppress route-local loaders while a global blocking action is active, leaving one visible loading surface.
• Load only each map route’s required Azure Maps capabilities.
• Add a staged “Preparing your workspace” experience for standard labeling through map ready, drawing setup, AOI fit, and stable idle frame.
• Dispose failed/abandoned maps safely and delay guided tours until readiness.
• Harden Interactive Labeler metadata/artifact cancellation and retry isolation.
• Extend the route matrix for staged labeling readiness and expected navigation aborts.

Testing

• Core library: 614 passed.
• HTTP API: 79 passed.
• Queue Functions: 6 passed.
• UI: 161 passed.
• Production Vite build: 2,423 modules in 399 ms.
• Black, isort, and Flake8 passed for five follow-up Python files.
• ESLint passed for 26 changed/new UI files.
• Route benchmark syntax and navigation-abort tests passed.
• VS Code diagnostics, Markdown links/tables/anchors, git diff --check, and feature-only detect-secrets passed.

Browser Evidence

• With Model Catalog and Active Jobs delayed by two seconds, Dashboard displayed one spinner and navigation to Help completed in 38 ms; both abandoned requests were aborted.
• With invalid local Azure Maps credentials, standard labeling displayed one persistent retry surface, no duplicate/global loader, no premature tour, and no application lifecycle exception.

Stack

• Depends on: perf(ui): lazy-load routes and Azure Maps assets [5/5] #189.
• This PR: app-wide follow-up, based on prbatero/feat/perf-ui-route-loading.
• Independent security fix: fix(api): reject client-supplied workflow state #184 remains separate.
• Current head: cdba898.

Open Gates

• Do not deploy the session-bootstrap path while the Function endpoint accepts public traffic and trusts x-ms-client-principal. Restrict ingress to trusted SWA/APIM traffic or validate signed identity first.
• Successful real-credential Azure Maps loading and the authenticated desktop/mobile Dev1 route matrix remain unexecuted.
• The one-to-three-second production route target is therefore not yet claimed as achieved.
• ADR-0005 remains proposed and rollout remains blocked until these gates close.