Compress what the browser downloads, and stop one tile taking the page

**nginx served the bundle uncompressed and uncacheable.** The base image
ships gzip commented out and nothing set `Cache-Control`, so every load
carried the whole thing and every reload cost a 304 per asset. Measured on
the built image: the entry chunk 838 kB → 311 kB, the Monaco chunk 2.66 MB
→ 832 kB, and the ~50 content-hashed assets are now immutable for a year.
`index.html` is explicitly `no-cache`, since it is what names the rest.

**A widget that throws no longer blanks the screen.** There was one error
boundary in the app, on the root route, so anything that threw replaced
everything including the navigation — on `/view/{name}`, an unattended wall
panel with no way back. Each tile has its own boundary now, and the app
shell has one inside it so a screen that fails leaves the sidebar standing.
`react-error-boundary` was already a dependency and imported nowhere.

**`localStorage` cannot take the app down.** Reaching it raises where the
browser blocks site data, and `setItem` raises once the origin's quota is
full — which the flow editor's node clipboard, carrying whole Python
sources, can genuinely reach. Thrown from a key handler that escaped to
`window.onerror`, which the single root boundary then turned into a blank
page. `lib/safeStorage.ts` is the guarded pair the pre-paint theme script in
`index.html` was already using; a copy too large to store now says so.

Queries default to `staleTime: 5000` — below every poll interval on any
screen, so nothing polls less often than it did, but a route mounting twice
in a few seconds stops refetching everything it touches. Window-focus
refetching is off: the socket pushes what changes and a reconnect
invalidates what it feeds, so a focus event has nothing of its own to say.
Home alone reads about ten queries on every one of those.

Render cost, two that showed up in the audit:

- `LogsPanel` was rendered unconditionally by the dock and decided inside
  itself whether to draw, so with the panel *shut* it still subscribed to
  the log store and re-filtered five hundred lines per line a flow
  published. It returns before any of that now.
- `HealthActivity` subscribed to the whole engine-event array and used one
  number from it, so a flapping node re-rendered the component that draws
  Home's two uPlot charts — each of which rebuilds its series on every
  render by design. It subscribes to that number.
- the global search bucketed the index nine times per keystroke, once per
  group. One pass, and each group offers at most twenty.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M6hPWS6YEbT1P8LxhhFb2T

frontend/src/components/Dashboard/widgets.tsx

@@ -1,4 +1,6 @@
+import { TriangleAlert } from "lucide-react"
 import { useState } from "react"
+import { ErrorBoundary } from "react-error-boundary"
 
 import type { WidgetDef } from "@/client"
 import { cn } from "@/lib/utils"
@@ -637,5 +639,22 @@ export function WidgetBody({ widget, dashboard }: WidgetProps) {
       </p>
     )
   }
-  return <Renderer widget={widget} dashboard={dashboard} />
+  return (
+    // Per tile, because a dashboard is often the only thing on a screen
+    // nobody is standing at: one widget whose config the renderer cannot make
+    // sense of used to throw past every ancestor and leave a wall panel
+    // blank, with no navigation to recover from.
+    <ErrorBoundary fallback={<WidgetFailed />} resetKeys={[widget.id]}>
+      <Renderer widget={widget} dashboard={dashboard} />
+    </ErrorBoundary>
+  )
+}
+
+function WidgetFailed() {
+  return (
+    <p className="flex h-full items-center justify-center gap-2 text-muted-foreground text-sm">
+      <TriangleAlert className="size-4 shrink-0" aria-hidden />
+      This tile could not be drawn.
+    </p>
+  )
 }