feat(analytics): instance census, full capture, richer error context (#511)

Add a once-per-boot instance_started event (arch, os, deploy_mode,
gpu_present) so the fleet architecture mix is measurable. It reuses the
existing per-instance instance_id and is exempt from the volume sample
rate, since a census that fires once per boot must not be thinned.

Restore useful capture depth now that the sponsored plan removes the
quota pressure behind the earlier hardening:

- PostHog sample rate 0.1 to 1.0 (full analytics when enabled); the
  property allowlist still blocks file data.
- Sentry per-instance ceiling 20 to 500/hr, breadcrumb trail restored
  (sanitized: urls/paths redacted, data payloads dropped), full stack
  paths kept; local vars, request bodies, and PII still dropped. Both
  api and web.

Honor ANALYTICS_ENABLED=false as an opt-out alias: it was documented on
the Docker Hub README but never wired in 2.x, so anyone who set it was
still tracked.

All capture stays behind the analytics opt-out gate.

tests/unit/api/analytics-allowlist.test.ts

@@ -36,4 +36,21 @@ describe("sanitizeEventProperties", () => {
     const out = sanitizeEventProperties("totally_new_event", { anything: "x" });
     expect(out).toEqual({});
   });
+
+  it("keeps only allow-listed keys for instance_started", () => {
+    const out = sanitizeEventProperties("instance_started", {
+      arch: "arm64",
+      os_platform: "linux",
+      deploy_mode: "embedded",
+      gpu_present: false,
+      hostname: "leaked-hostname",
+    });
+    expect(out).toEqual({
+      arch: "arm64",
+      os_platform: "linux",
+      deploy_mode: "embedded",
+      gpu_present: false,
+    });
+    expect(out).not.toHaveProperty("hostname");
+  });
 });