feat(analytics): upload web source maps to Sentry + tie release to build (#369)

* feat(analytics): upload web source maps to Sentry + tie release to build

Web crash reports were unusable: the bundle ships minified with no source
maps uploaded, and every build reported as the frozen APP_VERSION, so a
Sentry error showed an unreadable stack under a single release.

- Add @sentry/vite-plugin: emit hidden source maps and upload them by debug
  id when SENTRY_AUTH_TOKEN is present (published Docker build only), then
  delete the maps so they never ship. No-op for dev and the source archive.
- Set the Sentry release from SENTRY_RELEASE / VITE_SENTRY_RELEASE (the Docker
  build passes the release version), falling back to APP_VERSION.
- Relax beforeSend so app bundle frames keep a host-stripped path (Sentry needs
  it to match the uploaded map) while the instance hostname, error message, and
  PII stay stripped. Filesystem paths still collapse to the basename.
- Wire the Dockerfile (sentry_auth_token build secret + SENTRY_RELEASE arg/env)
  and the release docker job.

* fix(analytics): point source map upload at the snapotter org (project node)

apps/web/vite.config.ts

@@ -1,10 +1,34 @@
 import path from "node:path";
+import { sentryVitePlugin } from "@sentry/vite-plugin";
 import tailwindcss from "@tailwindcss/vite";
 import react from "@vitejs/plugin-react";
 import { defineConfig } from "vite";
 
+// Source maps are emitted and uploaded to Sentry only when the build supplies
+// SENTRY_AUTH_TOKEN (the published Docker image does; dev and the source-archive
+// build do not). Debug IDs tie each build's bundle to its own maps, so upload
+// works regardless of release. Maps are deleted after upload so they never ship.
+const sentryAuthToken = process.env.SENTRY_AUTH_TOKEN;
+const sentryRelease = process.env.SENTRY_RELEASE;
+
 export default defineConfig({
-  plugins: [react(), tailwindcss()],
+  plugins: [
+    react(),
+    tailwindcss(),
+    // Must come after the other plugins so it sees the final bundle.
+    sentryVitePlugin({
+      org: "snapotter",
+      project: "node",
+      authToken: sentryAuthToken,
+      telemetry: false,
+      disable: !sentryAuthToken,
+      applicationKey: "snapotter-web",
+      // Don't inject the release into the bundle; the SDK reads it explicitly
+      // from VITE_SENTRY_RELEASE so there is a single source of truth.
+      release: { name: sentryRelease, inject: false },
+      sourcemaps: { filesToDeleteAfterUpload: ["./dist/**/*.map"] },
+    }),
+  ],
   resolve: {
     alias: {
       "@": path.resolve(__dirname, "./src"),
@@ -36,6 +60,9 @@ export default defineConfig({
     },
   },
   build: {
+    // Hidden source maps: generated for upload but not referenced from the
+    // shipped JS, so browsers never fetch them. Off entirely when not uploading.
+    sourcemap: sentryAuthToken ? "hidden" : false,
     rollupOptions: {},
   },
 });