feat(analytics): upload web source maps to Sentry + tie release to build (#369)

* feat(analytics): upload web source maps to Sentry + tie release to build

Web crash reports were unusable: the bundle ships minified with no source
maps uploaded, and every build reported as the frozen APP_VERSION, so a
Sentry error showed an unreadable stack under a single release.

- Add @sentry/vite-plugin: emit hidden source maps and upload them by debug
  id when SENTRY_AUTH_TOKEN is present (published Docker build only), then
  delete the maps so they never ship. No-op for dev and the source archive.
- Set the Sentry release from SENTRY_RELEASE / VITE_SENTRY_RELEASE (the Docker
  build passes the release version), falling back to APP_VERSION.
- Relax beforeSend so app bundle frames keep a host-stripped path (Sentry needs
  it to match the uploaded map) while the instance hostname, error message, and
  PII stay stripped. Filesystem paths still collapse to the basename.
- Wire the Dockerfile (sentry_auth_token build secret + SENTRY_RELEASE arg/env)
  and the release docker job.

* fix(analytics): point source map upload at the snapotter org (project node)

apps/api/src/instrument.ts

@@ -17,10 +17,13 @@ if (ANALYTICS_BAKED.sentryDsn) {
   try {
     const Sentry = await import("@sentry/node");
     const { APP_VERSION } = await import("@snapotter/shared");
+    // The Docker build sets SENTRY_RELEASE to the release version so errors
+    // attribute to a build; falls back to APP_VERSION for non-image runs.
+    const release = process.env.SENTRY_RELEASE || APP_VERSION;
 
     Sentry.init({
       dsn: ANALYTICS_BAKED.sentryDsn,
-      release: APP_VERSION,
+      release,
       environment: process.env.NODE_ENV || "production",
       tracesSampleRate: ANALYTICS_BAKED.sampleRate,
       sendDefaultPii: false,
@@ -59,7 +62,7 @@ if (ANALYTICS_BAKED.sentryDsn) {
       },
     });
 
-    console.log("[sentry] initialized, release:", APP_VERSION);
+    console.log("[sentry] initialized, release:", release);
   } catch {
     // @sentry/node not available
   }