feat(analytics): add PostHog (EU) behind a same-origin proxy (#1237)

Recapt shuts down in four days, taking product analytics and session
replay with it. This adds PostHog Cloud EU alongside it; the Recapt
removal follows separately so events can be confirmed landing first.

Wiring choices that are not the tutorial defaults:

- Same-origin reverse proxy (/rl -> eu.i.posthog.com) instead of adding
  PostHog hosts to the CSP. connect-src 'self' and script-src 'self'
  already cover it, tracking blockers have no third-party host to match,
  and the Recapt allowlist entries in next.config.ts get replaced by
  nothing at all when they go. Needs skipTrailingSlashRedirect, since
  PostHog sends trailing-slash API requests; verified that trailing-slash
  URLs on normal routes still resolve 200 rather than 404.

- /rl is excluded from the proxy.ts matcher. Middleware runs BEFORE
  next.config rewrites, so without this updateSession() treats an
  ingestion POST as an unknown protected path and 307s it to /login.
  Verified with a control: /zz/flags/ -> 307 /login, /rl/flags/ -> 200
  from PostHog. This fails silently otherwise, because asset loads keep
  working through the rewrite while no events arrive.

- persistence: 'memory' so nothing is written to the device and no
  cookie-consent banner is required. Everything post-login is unaffected:
  AnalyticsIdentify re-identifies on each dashboard load.

- session_recording.maskTextSelector: '*'. PostHog masks inputs but not
  text by default, and this app renders org numbers (which for an
  enskild firma ARE the owner's personnummer), customer names and
  balances as ordinary text. Replays show where a user gets stuck, never
  what their books say. buildGroupProperties() also refuses to send
  org_number at all, with a test pinning it.

- Error tracking registers through the existing lib/observability sink
  rather than bypassing it, so every error-level createLogger() line is
  captured already redacted. instrumentation.ts onRequestError covers
  what escapes uncaught.

Analytics is hosted-only: isAnalyticsEnabled() short-circuits on
NEXT_PUBLIC_SELF_HOSTED and no Docker sentinel is added, so self-hosted
runs with zero third-party runtime code. Recapt got that outcome only by
accident, via a missing sentinel; here it is explicit and tested.

vitest.config.ts aliases 'server-only' to a stub: it is a build-time
guard whose real entry point always throws, which broke 48 test files the
moment a server-only module entered the graph. request-context.ts was
already carrying the same latent trap.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

.env.example

@@ -53,12 +53,28 @@ CRON_SECRET=generate-a-random-secret
 # BOLAGSVERKET_ARELLE_VALIDATOR_URL=
 # BOLAGSVERKET_ARELLE_VALIDATOR_TOKEN=
 
+# ── Optional: product analytics + error tracking (PostHog) ─
+# Hosted only. Self-hosted deployments never load PostHog: isAnalyticsEnabled()
+# (lib/analytics/enabled.ts) short-circuits on NEXT_PUBLIC_SELF_HOSTED=true, and
+# no __NEXT_PUBLIC_POSTHOG_*__ sentinel is baked into the Docker image, so an
+# operator cannot accidentally ship their users' behaviour to our project.
+#
+# The token is the PUBLIC project token (phc_...). It is embedded in the client
+# bundle by design and is not a secret. Leave unset to run with analytics off.
+# Browser traffic goes through the same-origin /rl rewrite in next.config.ts;
+# NEXT_PUBLIC_POSTHOG_HOST is only used by the server-side SDK.
+# NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=
+# NEXT_PUBLIC_POSTHOG_HOST=https://eu.i.posthog.com
+
 # ── Optional: error tracking / observability ──────────────
 # The app routes every error-level log line, and anything flagged
-# `alert: true`, to a provider-agnostic sink (lib/observability). No vendor is
-# wired up: the sink is a NO-OP until an adapter is registered with
-# registerObservabilitySink(). Setting these variables alone changes nothing,
-# and self-hosted installs can leave them unset forever.
+# `alert: true`, to a provider-agnostic sink (lib/observability). When the
+# PostHog token above is set, lib/init.ts registers the PostHog adapter
+# (lib/analytics/posthog-observability.ts) as that sink; otherwise the sink
+# stays a NO-OP, the PostHog client is never constructed and nothing is ever
+# sent. (The SDK is still bundled in those builds, since the imports are
+# static; it simply never initialises.) The variables below are for a
+# DIFFERENT vendor adapter and still change nothing on their own.
 #
 # Names are generic placeholders. When a provider is picked, either keep these
 # and read them in the adapter, or replace them with the vendor's own names.