fix(web): shrink GROQ query weight + gate SanityLive behind draft mode

[damianrosellen1]

Follow-up to #136, implementing the cross-repo audit findings (same audit as farbstudio) for this repo. Stacked on fix/web-ttfb-cls — retarget to main once #136 merges.

1. Dead query weight (3cf1317)

settingsBundleQuery (312 KB), siteNavQuery (79 KB), siteSettingsQuery (77 KB) and siteCookieBannerQuery (77 KB) were exported but never imported outside the queries folder — ~546 KB of GROQ template strings built on every server cold start. errorSettingsQuery embedded modulesQuery (77 of its 79 KB) although no error page renders modules.

• String exports at module init: 1.20 MB → 0.46 MB
• errorSettingsQuery: 78.9 KB → 1.8 KB
• READMEs updated; ErrorSettingsDocument loses its dead modules field

2. Rich-text projection blow-up (c29df3d)

Unlike farbstudio (where contentRefs was the driver — ours is lean), the blow-up here was buildRichTextMediaQuery(3): it repeated the full module.media / module.carousel / module.contentRefs projections (~19 KB) per nesting level. @sanity/client POSTs anything over 14,800 chars and sanityFetch fires two fetches per query (sync-tags probe + data) → ~154 KB upload per page query per uncached render.

Module projections now live only at the top level of a rich-text body; nested module.text keeps resolving blocks + link marks through the full depth.

Query	before	after
richTextMediaQuery	58.7 KB	22.1 KB
homeQuery / pageBySlugQuery / workQuery	77.3 KB	40.7 KB (−47%)
projectBySlugQuery	63.6 KB	27.1 KB

Trade-off (deliberate): media modules embedded inside a nested text module arrive with raw stored fields only and aren't expected to render — top-level rich text remains the module surface. Verified: trimmed homeQuery returns the full document against the live dataset; /work/design still renders all five rich-text-embedded media figures; page HTML sizes unchanged.

3. SanityLive gated behind Draft Mode (f643caa)

<SanityLive /> mounted for every visitor once SANITY_API_READ_TOKEN was set: an SSE connection per tab + a revalidateSyncTagsAction server-action round trip per publish event per tab. It had to — sanityFetch cache entries carried only sanity:* sync tags (revalidate: false, 1y cacheLife), which nothing but a mounted SanityLive revalidates.

The fix makes the webhook the published-content invalidation path, then gates Live:

• every sanityFetch wrapper tags its cache entry with the matching SANITY_CACHE_TAGS constant
• /api/revalidate covers the shell singletons (siteNav + siteCookieBanner added to the allow-list; siteSettings/errorSettings now map to tags)
• SanityLive mounts for Draft Mode — and, as a freshness fallback, whenever a token is set but no SANITY_REVALIDATE_SECRET is configured (webhook-less setups keep today's behavior)

Verified end-to-end on the production build: HMAC-signed webhook posts for page / siteNav / siteSettings / siteCookieBanner / errorSettings → revalidated: true and pages re-serve fresh; a full browser page load performs zero requests to *.sanity.io (previously an SSE connection to /data/live/events). No token leak existed before (next-sanity only sends browserToken in draft mode) — the win is connection + action traffic. Client JS is unchanged: the remaining @sanity/client/stega chunks come from useOptimistic (next-sanity/hooks) in ModulesRendererClient, not from Live — possible follow-up.

Not done (deliberately)

• Shell-query bundling (nav + cookie + title + favicon in one fetch): after fix(web): faster server response + no layout shift on load and transitions #136 those fetches only run during background ISR regeneration, and bundling would couple four unrelated singletons into one cache entry (coarser invalidation) while crossing the root/locale layout boundary. Low value here — skipped.
• loading.tsx deletion (farbstudio plan): our routes are SSG, the skeleton never streams on initial load; the 300 ms delay from fix(web): faster server response + no layout shift on load and transitions #136 already removes the transition flash while keeping feedback for slow draft-mode navigations.

Verified

• pnpm typecheck + pnpm format clean, production build green, all routes still SSG/ISR
• Query-size harness before/after (numbers above)
• Live-dataset smoke tests: trimmed queries return full documents; embedded rich-text media renders
• Webhook HMAC verification + tag mapping for all document types
• Browser network capture: no sanity.io traffic on anonymous pages

🤖 Generated with Claude Code