fix(analytics): mask session replays by default, chrome-only unmask (#1639)

* fix(analytics): mask session replays by default, chrome-only unmask

Invert PostHog session-replay masking from visible-by-default with pattern
masking to deny-by-default: every input value is masked wholesale (rrweb
maskAllInputs, no maskInputFn) and every text node is masked unless it sits
under data-ph-unmask chrome or a table column header (th). Chrome tags live
on the shared UI primitives (PageHeader, Label, Button except combobox
triggers, TabsTrigger, Badge, Card/Dialog/Sheet titles, tooltips, help
popovers, empty states, settings labels), and tagged chrome is still
pattern-scrubbed for amounts and person-/organisationsnummer. data-ph-mask
beats data-ph-unmask, so call sites that interpolate user data into chrome
stay masked; a very-thorough audit swept every unmasked primitive and each
found site got a call-site mask. Confirm-dialog wrappers and toasts stay
masked centrally: their copy describes user objects by design. Untagged new
UI over-masks instead of leaking. Privacy policy, RoPA and decision log
updated in the same change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(analytics): tag detail-section chrome merged from main

The register-detail primitives landed on main after the replay-masking
audit ran: kickers and DefRow labels are static i18n chrome, values stay
masked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(analytics): close skeptic and review findings on replay masking

Explicit data-ph tags now resolve before the th chrome fallback, so a th
nested inside a data-ph-mask container masks correctly (regression test
added). Seven missed text-leak sites get call-site masks: delete-invoice
and credit-page invoice numbers, IB-correction voucher reference, TIC
orgnr (served unnormalized, so the separator-based scrub cannot be relied
on), articles search-term empty state, dimension segment labels, and
activate-account buttons. The attribute channel is closed with rrweb's
blockClass: inputs whose placeholder carries an effective user value
(salary overrides, correction description, danger-zone confirms, credit
confirm) get ph-no-capture, removing the element from recordings while
the prefill UX stays intact; the pivot-th title attribute is dropped.
Privacy-policy effective date bumped to 2026-08-17.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

components/orders/CreateInvoiceFromOrderDialog.tsx

@@ -78,8 +78,9 @@ export default function CreateInvoiceFromOrderDialog({
     <Dialog open={open} onOpenChange={onOpenChange}>
       <DialogContent className="max-w-lg">
         <DialogHeader>
-          <DialogTitle>{t('invoice_title', { number: order.order_number })}</DialogTitle>
-          <DialogDescription>
+          {/* data-ph-mask: order number and customer name are user data */}
+          <DialogTitle data-ph-mask="">{t('invoice_title', { number: order.order_number })}</DialogTitle>
+          <DialogDescription data-ph-mask="">
             {t('invoice_description', { customer: customerLabel })}
           </DialogDescription>
         </DialogHeader>

components/orders/OrderBookingDialog.tsx

@@ -114,7 +114,8 @@ export default function OrderBookingDialog({
     <Dialog open={open} onOpenChange={onOpenChange}>
       <DialogContent className="max-h-[90vh] max-w-3xl overflow-y-auto">
         <DialogHeader>
-          <DialogTitle>
+          {/* data-ph-mask: the order number is user data */}
+          <DialogTitle data-ph-mask="">
             {isRefund
               ? t('book_refund_title', { number: order.order_number })
               : t('book_title', { number: order.order_number })}

components/orders/PaymentMethodMappingForm.tsx

@@ -167,7 +167,7 @@ export function PaymentMethodMappingForm({
         const mode = policy?.mode ?? 'book'
         const account = policy?.mode === 'book' ? policy.account : ''
         return (
-          <SettingsRow key={method} label={title || method}>
+          <SettingsRow key={method} label={<span data-ph-mask="">{title || method}</span>}>
             <SettingsRowEnd>
               <select
                 value={policy ? mode : 'unmapped'}