Fix 1 (nginx.conf): serve content-hashed /assets/* with a 1y immutable
Cache-Control while keeping index.html and config/runtime-config.js
non-cached, so repeat visits stop re-fetching the whole bundle.

Fix 2: stop the unauthenticated /landing page from eagerly downloading
the full app. Convert OSS route pages and enterprise plugin route
elements to React.lazy behind a single <Suspense>, and lazy-load the
app shell (PageLayout/FullPageLayout) which transitively pulled the
PDF viewer, charts and lookup-studio onto /landing.

New helper src/helpers/pluginRegistry.js (lazyPlugin) defers plugin
chunks to navigation; OSS builds resolve the stub and fall back to
NotFound, so absent-plugin routes 404 harmlessly as before.

Measured /landing script requests: 201 -> 93; pdf-vendor, recharts and
Monaco no longer load until navigated to. OSS-parity build (no
src/plugins) verified.

…bsent check

- nginx: drive Cache-Control from a $uri map at server scope instead of
  per-location add_header. Location-level add_header replaces (not merges)
  the inherited server headers, which dropped X-Content-Type-Options/
  X-Frame-Options/Referrer-Policy/CSP from /assets, index.html and
  runtime-config.js. Now both locations carry no add_header and inherit all
  security + cache headers.
- pluginRegistry: only treat the build-time stub ('Optional plugin not
  available') as plugin-absent; rethrow transient chunk-load failures of a
  shipped plugin instead of masking them as NotFound.
- useMainAppRoutes: gate the OnboardProduct wrapper on PRODUCT_NAMES.unstract
  (the value passed as type) rather than the map being non-empty.

Pull the repeated 'lazy a named export' pattern into src/helpers/lazyNamed.js
and use it in Router.jsx and useMainAppRoutes.js instead of inline
.then((m) => ({ default: m.X })) / a per-file 'named' helper. Behaviour is
identical; /landing chunk count unchanged. Addresses cloud-PR review feedback
about the duplicated helper (the two route hooks import the same util).

- Wrap the route <Suspense> in Router.jsx with the existing ErrorBoundary and
  a reload-prompt fallback. lazyPlugin/lazyNamed rethrow non-stub failures
  (e.g. a transient chunk-load blip), and App rendered <Router/> with no
  boundary — so such a failure would unmount the tree to a blank screen.
  The boundary now contains it and offers a reload (which re-fetches the chunk).
- lazyNamed: throw a descriptive error when the requested named export is
  missing instead of handing React.lazy { default: undefined } (opaque error).

Addresses greptile P1 (no ErrorBoundary) and CodeRabbit (lazyNamed validation).

… dead guard

Review round 3:
- lazyPlugin: validate the resolved export (mirror lazyNamed). A shipped plugin
  whose named export was renamed/removed now throws a descriptive error instead
  of handing React.lazy { default: undefined }; isPluginAbsent doesn't match it,
  so it re-throws to the ErrorBoundary rather than masking as NotFound.
- ErrorBoundary: support resetKeys — clear the error when a key changes (e.g.
  location), so navigation recovers without a full reload.
- New LazyOutlet (content-scoped <Suspense> + nav-resettable ErrorBoundary +
  <Outlet/>); PageLayout/FullPageLayout use it instead of a bare <Outlet/>.
  Per-page load spinners and chunk-load failures now stay in the content area
  with the shell mounted; the app-wide boundary in Router.jsx remains the
  backstop and is now also location-reset. Fixes the blast-radius / no-recovery
  and shell-blanks-on-first-nav issues from the single top-level boundary.
- useMainAppRoutes: remove the now-dead 'ReadOnlyReviewPage && !ReviewLayout'
  warning — with lazyPlugin both are always truthy so it could never fire; the
  route degrades to NotFound if manual-review is absent.

Build green (with and without src/plugins); biome clean.

…loy)

The route ErrorBoundary already catches a rejected dynamic import() (a
<Suspense> alone only handles the pending state). Add chunk-error handling so
the common production trigger — a stale hashed chunk after a redeploy (client
requests a filename the CDN no longer serves) — auto-recovers:

- isChunkLoadError() detects the failed-dynamic-import error across browsers.
- handleRouteError() (wired as onError on both the app-wide boundary in
  Router.jsx and the content-scoped one in LazyOutlet) reloads ONCE to pick up
  fresh chunk hashes, guarded by a sessionStorage timestamp so a genuinely-gone
  chunk falls through to the manual Reload fallback instead of looping.
  Non-chunk render errors are never auto-reloaded.

This covers the outermost lazy route elements too (e.g. FullPageLayout for
verticals, OnboardProduct for llm-whisperer), which render under the Router
boundary.