perf(insights,api): always answer instantly and regenerate in the background

The insights read path served a cold cache by generating inline — up to
ten seconds on first visit — and the nightly warm pass structurally
excluded evening visitors: their visit stamped the cache, the half-four
run skipped it as fresh, and it expired exactly at the next evening's
visit. Stale content now serves immediately with its timestamp while
one background job revalidates, the warm threshold drops to an hour,
forced warming fills both message locales, the analytics caches serve
stale-while-revalidate, the profile endpoint parallelises its reads,
the bug-report status drops a write per call, the umami proxy degrades
to a no-op script instead of an error, the insights route sheds its
heaviest static imports, and the medication page prefetches on intent.

src/app/api/monitoring/umami-script/route.ts

@@ -26,16 +26,33 @@ export const GET = apiHandler(async () => {
     });
   }
 
-  const response = await safeFetch(
-    settings.umamiScriptUrl,
-    {
-      next: { revalidate: 3600 },
-    },
-    // Operator-configured host — pin the connect-time IP so a low-TTL
-    // DNS record cannot rebind the fetch at an internal range between
-    // the input-time `isPublicUrl` accept and the socket connect.
-    { requirePublicHost: true },
-  );
+  // Fail-soft: an unreachable / slow / rebinding-refused upstream must
+  // degrade to the noop script, not 500 the proxy route — `safeFetch`
+  // THROWS on its 15 s timeout and on the connect-time public-host
+  // refusal, and an uncaught throw here surfaced as a 500 on every
+  // mount whenever the operator's Umami host was down or unresolvable.
+  let response: Response;
+  try {
+    response = await safeFetch(
+      settings.umamiScriptUrl,
+      {
+        next: { revalidate: 3600 },
+      },
+      // Operator-configured host — pin the connect-time IP so a low-TTL
+      // DNS record cannot rebind the fetch at an internal range between
+      // the input-time `isPublicUrl` accept and the socket connect.
+      { requirePublicHost: true },
+    );
+  } catch {
+    annotate({ meta: { umami_script_fetch_failed: true } });
+    return new NextResponse(NOOP_SCRIPT, {
+      status: 200,
+      headers: {
+        "Content-Type": "application/javascript; charset=utf-8",
+        "Cache-Control": "public, max-age=60",
+      },
+    });
+  }
   if (!response.ok) {
     return new NextResponse(NOOP_SCRIPT, {
       status: 200,