fix(telemetry): data-quality pass (opt-in noise, onboarding split, file_count, OIDC) (#614)

Five fixes to the PostHog event stream, from an audit of what we actually collect versus what's flowing in. Each one is test-first.

## What changed

**Silenced the `$opt_in` noise.** `initAnalytics` called `opt_in_capturing()` on every page load to clear a stale opt-out flag, and posthog-js emits an `$opt_in` event on every call. That was 10k+ events a month (up to 55 per user) carrying no signal: analytics is on by default with an admin opt-out, so there is no per-user consent to record. Both call sites now pass `captureEventName: false`.

**Split the onboarding survey out of `feedback_submitted`.** The onboarding usage survey rode the same event as real feedback, so about 93% of "feedback" was actually onboarding profiling. It now emits `onboarding_survey_submitted`, so feedback metrics mean feedback again.

**Set `pipeline_executed.file_count`.** It was declared in the properties interface but never populated. A pure `pipelineExecutedProps` helper now derives it (batch size for a batch run, else 1) and is shared by the success and failure paths, which also drops a duplicated payload.

**Tracked OIDC login failures.** All six OIDC callback failure branches bumped the Prometheus counter and wrote an audit log but never emitted `auth_login_failed`. A `recordOidcFailure` helper mirrors the password path.

**Added `TELEMETRY.md`.** A contributor-facing event dictionary: every event, its properties, where it fires, and the privacy invariants, with the allowlists as source of truth. A drift test fails if any `ANALYTICS_EVENTS` value goes undocumented.

I left the published telemetry guide (`apps/docs/guide/telemetry.md`) alone. It is high-level and still accurate, and editing it would pull in the 21-locale stale-gate for no gain.

## Verification

- Unit (63 tests): `analytics-events`, `telemetry-doc-drift`, `api/analytics`, `web/analytics`, `worker.behavior`
- Integration (41 tests): `oidc-auth`, `feedback`
- Full typecheck across all 9 workspaces
- Biome clean on the changed files

All green locally.

tests/integration/platform/oidc-auth.test.ts

@@ -12,11 +12,19 @@
 import { randomUUID } from "node:crypto";
 import { createServer, type Server } from "node:http";
 import { eq } from "drizzle-orm";
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
 import { env } from "../../../apps/api/src/config.js";
 import { db, schema } from "../../../apps/api/src/db/index.js";
 import { buildTestApp, loginAsAdmin, type TestApp } from "../test-server.js";
 
+// trackEvent is mocked so OIDC failure analytics can be asserted without a
+// baked PostHog client; every other analytics export stays real.
+const trackEventSpy = vi.hoisted(() => vi.fn().mockResolvedValue(undefined));
+vi.mock("../../../apps/api/src/lib/analytics.js", async (importOriginal) => {
+  const actual: Record<string, unknown> = await importOriginal();
+  return { ...actual, trackEvent: trackEventSpy };
+});
+
 // ── Helpers ──────────────────────────────────────────────────────────
 
 let testApp: TestApp;
@@ -616,6 +624,7 @@ describe("OIDC callback edge cases", () => {
     const state = redirectUrl.searchParams.get("state");
 
     // Simulate IdP returning an error
+    trackEventSpy.mockClear();
     const callbackRes = await oidcApp.app.inject({
       method: "GET",
       url: `/api/auth/oidc/callback?error=access_denied&error_description=User+denied&state=${state}`,
@@ -625,6 +634,9 @@ describe("OIDC callback edge cases", () => {
     expect(callbackRes.statusCode).toBe(302);
     const location = callbackRes.headers.location as string;
     expect(location).toContain("/login?error=oidc_auth_failed");
+    // The failed attempt is recorded as auth_login_failed (parity with the
+    // password path) so OIDC failures aren't invisible in analytics.
+    expect(trackEventSpy).toHaveBeenCalledWith("auth_login_failed", { method: "oidc" });
   });
 });