feat(analytics): instance census, full capture, richer error context (#511)

Add a once-per-boot instance_started event (arch, os, deploy_mode,
gpu_present) so the fleet architecture mix is measurable. It reuses the
existing per-instance instance_id and is exempt from the volume sample
rate, since a census that fires once per boot must not be thinned.

Restore useful capture depth now that the sponsored plan removes the
quota pressure behind the earlier hardening:

- PostHog sample rate 0.1 to 1.0 (full analytics when enabled); the
  property allowlist still blocks file data.
- Sentry per-instance ceiling 20 to 500/hr, breadcrumb trail restored
  (sanitized: urls/paths redacted, data payloads dropped), full stack
  paths kept; local vars, request bodies, and PII still dropped. Both
  api and web.

Honor ANALYTICS_ENABLED=false as an opt-out alias: it was documented on
the Docker Hub README but never wired in 2.x, so anyone who set it was
still tracked.

All capture stays behind the analytics opt-out gate.

tests/unit/shared/analytics-events.test.ts

@@ -2,8 +2,8 @@ import { ANALYTICS_EVENTS } from "@snapotter/shared";
 import { describe, expect, it } from "vitest";
 
 describe("ANALYTICS_EVENTS", () => {
-  it("has exactly 14 event keys", () => {
-    expect(Object.keys(ANALYTICS_EVENTS)).toHaveLength(14);
+  it("has exactly 15 event keys", () => {
+    expect(Object.keys(ANALYTICS_EVENTS)).toHaveLength(15);
   });
 
   it("contains the expected keys", () => {
@@ -21,6 +21,7 @@ describe("ANALYTICS_EVENTS", () => {
     expect(ANALYTICS_EVENTS).toHaveProperty("BATCH_PROCESSED");
     expect(ANALYTICS_EVENTS).toHaveProperty("FEEDBACK_SUBMITTED");
     expect(ANALYTICS_EVENTS).toHaveProperty("SPONSOR_CLICKED");
+    expect(ANALYTICS_EVENTS).toHaveProperty("INSTANCE_STARTED");
   });
 
   it("all event values are strings", () => {
@@ -49,6 +50,10 @@ describe("ANALYTICS_EVENTS", () => {
     expect(ANALYTICS_EVENTS.FEEDBACK_SUBMITTED).toBe("feedback_submitted");
   });
 
+  it("INSTANCE_STARTED has the correct snake_case value", () => {
+    expect(ANALYTICS_EVENTS.INSTANCE_STARTED).toBe("instance_started");
+  });
+
   it("all values follow snake_case convention", () => {
     for (const value of Object.values(ANALYTICS_EVENTS)) {
       expect(value).toMatch(/^[a-z][a-z0-9_]*$/);