fix: error-only Sentry telemetry, storm-proof capture, and crash fixes (#476)

Removes Sentry tracing entirely (BullMQ idle polling burned 4.8M transactions in 2 days at the baked 0.1 rate), decouples PostHog sampling, and replaces the type-only error scrub with a vetted-field sanitizer plus SafeError/ToolInputError contracts. One classified capture path with per-signature throttles and a per-process ceiling makes storms impossible (NODE-1E was 4,541 events from one 30s loop). Browser errors move to a dedicated web Sentry project with their own source maps. Adds the SNAPOTTER_TELEMETRY runtime kill switch and silences test fleets.

Crash fixes: remote 204/304 SSRF process kill (NODE-20), conversion-preset boot crash loop (NODE-21), Redis version preflight + unhandled subscribe rejection (NODE-1T), Sign PDF on plain-http origins (NODE-1K/1M), wavesurfer/pdf.js teardown rejections (NODE-1P/1N), bundle-import ZlibError to 400 (NODE-1Z), chart-maker input errors declassified (NODE-1H/1J), asset requests skip the session DB lookup (NODE-1D).

.env.example

@@ -81,6 +81,12 @@ LOG_DIR=./data/logs            # rotating log ring for support bundles
 # --- Analytics ---
 # Basic analytics are included by default. SnapOtter works normally without them.
 # To disable: docker compose build --build-arg SNAPOTTER_ANALYTICS=off
+# Runtime kill switch: set to 0 to disable ALL telemetry (Sentry + PostHog)
+# for this instance without rebuilding. The in-app admin toggle does the same
+# from Settings; this env var also covers boot-time crashes and CI fleets.
+# SNAPOTTER_TELEMETRY=1
+# Label this instance's error reports (shows as the Sentry environment).
+# SNAPOTTER_ENV=production
 
 # One-time SQLite import on first boot (1.x upgrade path). Leave unset normally.
 # SQLITE_MIGRATE_PATH=/data/snapotter.db