build(bundle): gate every page's first load and the distinct client code

The gate summed every emitted chunk once and watched five pages. The sum
counts a module once per chunk group it lands in, so it rose whenever a
page got lighter by moving code into on-demand chunks, and it needed a
raise in most releases while no reader downloaded more; and a heavy import
into a page outside the five went unseen.

scripts/check-bundle-budget.mjs now measures:

- the first load of every page: rootMainFiles plus the page's
  client-reference chunks, each file counted once by content hash;
- p50, p95 and max of those first loads across pages;
- the distinct client code: every chunk evaluated in a node:vm sandbox
  with a stub TURBOPACK array, each module factory counted once by its
  module id (not its text: each chunk is minified on its own, so copies of
  one module differ in mangled names), catalogs excluded, gzipped once.

The summed aggregate is still printed but no longer gated. The catalog,
per-catalog and one-Recharts checks are unchanged. `--write-baselines`
rewrites the per-page baselines, `--dir` measures another build directory,
`--json` writes the report.

bundle-budget.json is re-based from the v1.44.0 build (local arm64): 110
pages, first load p50 336, p95 437, max 451 KB gz; distinct client code
1904 KB gz in 1224 modules; summed aggregate 3875 KB for comparison. Every
page has a baseline with the same 20 KB allowance; caps are p95 447, max
461 and distinct code 1930 KB. A page without a baseline fails until one
is written in the same change.

Proof: importing zod into the weight insights page measured
/insights/weight at 427.8 KB gz, 88.8 KB over its 339 KB baseline, and the
gate failed; the old gate passed the same build, because the page was not
watched and the summed aggregate did not move (3875 KB). The import was
removed again.

.github/workflows/e2e.yml

@@ -93,11 +93,12 @@ jobs:
       - run: NODE_OPTIONS=--max-old-space-size=8192 pnpm build
 
       # Client-bundle budget gate — rides this job because it is the one
-      # place CI already has a production build on disk. Catches the
-      # regressions the dead webpack-era tooling (ANALYZE=1, the old
-      # bundle-report) let through: a statically imported message catalog
-      # (~100 KB gz on every route) or a chart import bypassing the shared
-      # chart-runtime boundary (a duplicated ~92 KB gz recharts chunk).
+      # place CI already has a production build on disk. Measures the first
+      # load of every page (files deduplicated by content hash) against its
+      # baseline, the p95 and max across pages, and the distinct client code
+      # (modules deduplicated by id); see the script header. Catches a
+      # statically imported message catalog, a duplicated recharts chunk, or
+      # a heavy module (Zod) pulled into a page that had none.
       - run: pnpm bundle-check
 
       - run: pnpm exec playwright test --shard=${{ matrix.shard }}/3