feat(telemetry): Sentry + PostHog quality pass (#546)

Comprehensive telemetry quality improvements across Sentry and PostHog, grounded in an audit of the live data plus current best-practice research.

Sentry: job_id/instance_id tags, operational fingerprinting, PII-safe settings context on bug events, web tag population + extension-noise filtering, an early-crash buffer, http status/method kept on breadcrumbs, and a gated-off-by-default performance-tracing re-enable (tracesSampler that zeroes db/redis/queue-poll root spans + drops the Redis integration) with worker job spans and canonical-host cron monitors.

PostHog: history_change SPA pageviews, instance_id super property for fleet rollups, enriched tool_used (formats, byte sizes, is_batch, execution_hint, real error_kind taxonomy), the previously-dead result_saved/batch_processed/ai_bundle_prompted events fired, search click-through, editor + Automate authoring + auth instrumentation, a before_send PII boundary, and minimal opt-in landing-site pageviews.

tests/unit/api/capture-path.test.ts

@@ -8,20 +8,33 @@
  * and the throttle allows one capture per distinct signature.
  */
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { reportError, resetThrottleForTests } from "../../../apps/api/src/lib/error-report.js";
+import {
+  reportError,
+  resetThrottleForTests,
+  setSentryInstanceTag,
+} from "../../../apps/api/src/lib/error-report.js";
 
 const h = vi.hoisted(() => {
-  const scope = { setTag: vi.fn(), setLevel: vi.fn(), setFingerprint: vi.fn() };
+  const scope = {
+    setTag: vi.fn(),
+    setLevel: vi.fn(),
+    setFingerprint: vi.fn(),
+    setContext: vi.fn(),
+  };
+  const globalScope = { setTag: vi.fn() };
   return {
     scope,
+    globalScope,
     captureException: vi.fn(),
     withScope: vi.fn((cb: (s: typeof scope) => unknown) => cb(scope)),
+    getGlobalScope: vi.fn(() => globalScope),
   };
 });
 
 vi.mock("@sentry/node", () => ({
   captureException: h.captureException,
   withScope: h.withScope,
+  getGlobalScope: h.getGlobalScope,
 }));
 
 vi.mock("../../../apps/api/src/lib/analytics-gate.js", () => ({
@@ -71,4 +84,58 @@ describe("capture path", () => {
     await reportError(denied, { source: "worker", pool: "image" });
     expect(h.captureException).toHaveBeenCalledTimes(2);
   });
+
+  it("tags job_id so the event cross-references the DB row, logs, and PostHog stream", async () => {
+    await reportError(new Error("boom"), { source: "worker", pool: "image", jobId: "job-abc" });
+    expect(h.scope.setTag).toHaveBeenCalledWith("job_id", "job-abc");
+  });
+
+  it("collapses operational errors to one issue per code via fingerprint", async () => {
+    const full = Object.assign(new Error("disk full"), { code: "ENOSPC" });
+    await reportError(full, { source: "worker", pool: "image" });
+    expect(h.scope.setFingerprint).toHaveBeenCalledWith(["operational", "ENOSPC"]);
+  });
+
+  it("prefers the connectivity fingerprint for infra-connectivity operational errors", async () => {
+    const pg = Object.assign(new Error("Failed query: select 1"), {
+      cause: Object.assign(new Error("57P01"), { code: "57P01" }),
+    });
+    await reportError(pg, { source: "worker", pool: "docs" });
+    expect(h.scope.setFingerprint).toHaveBeenCalledWith(["connectivity", "pg-unavailable"]);
+  });
+
+  it("leaves bug-class errors on default per-frame grouping (no fingerprint)", async () => {
+    await reportError(new Error("undefined is not a function"), {
+      source: "worker",
+      pool: "image",
+    });
+    expect(h.scope.setFingerprint).not.toHaveBeenCalled();
+  });
+
+  it("attaches a vetted tool context for bug-class events to aid reproduction", async () => {
+    await reportError(new Error("boom"), {
+      source: "worker",
+      pool: "image",
+      settings: { format: "png", quality: 80, filename: "my secret vacation.png" },
+    });
+    expect(h.scope.setContext).toHaveBeenCalledWith("tool", { format: "png", quality: 80 });
+  });
+
+  it("does not attach a settings context for non-bug errors", async () => {
+    const full = Object.assign(new Error("disk full"), { code: "ENOSPC" });
+    await reportError(full, { source: "worker", pool: "image", settings: { format: "png" } });
+    expect(h.scope.setContext).not.toHaveBeenCalled();
+  });
+});
+
+describe("setSentryInstanceTag", () => {
+  it("sets instance_id on the global scope so every event carries it", async () => {
+    await setSentryInstanceTag("inst-xyz");
+    expect(h.globalScope.setTag).toHaveBeenCalledWith("instance_id", "inst-xyz");
+  });
+
+  it("is a no-op on a falsy id and never throws", async () => {
+    await expect(setSentryInstanceTag("")).resolves.toBeUndefined();
+    expect(h.globalScope.setTag).not.toHaveBeenCalled();
+  });
 });