feat(analytics): build-time bake + telemetry depth (#336)

Bake PostHog + Sentry into the published Docker image (SNAPOTTER_ANALYTICS
build arg, codegen script). Delete entire consent system. Move event emission
to BullMQ worker. Add cross-tier identity stitching, Sentry performance
tracing on both tiers, frontend funnel events. Fix stateful regex bug.

86 files changed, 1593 insertions(+), 3747 deletions(-)

apps/api/src/plugins/auth.ts

@@ -435,9 +435,6 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
           mustChangePassword: env.SKIP_MUST_CHANGE_PASSWORD ? false : user.mustChangePassword,
           permissions: await getPermissions(user.role),
           teamName: teamRow?.name ?? user.team,
-          analyticsEnabled: user.analyticsEnabled ?? null,
-          analyticsConsentShownAt: user.analyticsConsentShownAt?.getTime() ?? null,
-          analyticsConsentRemindAt: user.analyticsConsentRemindAt?.getTime() ?? null,
         },
         expiresAt: expiresAt.toISOString(),
         ...(mfaRequired && { mfaRequired: true }),
@@ -498,9 +495,6 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
           role: "admin",
           mustChangePassword: false,
           permissions: await getPermissions("admin"),
-          analyticsEnabled: null,
-          analyticsConsentShownAt: null,
-          analyticsConsentRemindAt: null,
         },
         expiresAt: null,
       });
@@ -538,9 +532,6 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
         email: user.email ?? null,
         hasLocalPassword: !!user.passwordHash,
         hasOidcLink: !!user.externalId,
-        analyticsEnabled: user.analyticsEnabled ?? null,
-        analyticsConsentShownAt: user.analyticsConsentShownAt?.getTime() ?? null,
-        analyticsConsentRemindAt: user.analyticsConsentRemindAt?.getTime() ?? null,
       },
       expiresAt: session.expiresAt.toISOString(),
     });