feat(analytics): instance census, full capture, richer error context (#511)

Add a once-per-boot instance_started event (arch, os, deploy_mode,
gpu_present) so the fleet architecture mix is measurable. It reuses the
existing per-instance instance_id and is exempt from the volume sample
rate, since a census that fires once per boot must not be thinned.

Restore useful capture depth now that the sponsored plan removes the
quota pressure behind the earlier hardening:

- PostHog sample rate 0.1 to 1.0 (full analytics when enabled); the
  property allowlist still blocks file data.
- Sentry per-instance ceiling 20 to 500/hr, breadcrumb trail restored
  (sanitized: urls/paths redacted, data payloads dropped), full stack
  paths kept; local vars, request bodies, and PII still dropped. Both
  api and web.

Honor ANALYTICS_ENABLED=false as an opt-out alias: it was documented on
the Docker Hub README but never wired in 2.x, so anyone who set it was
still tracked.

All capture stays behind the analytics opt-out gate.

tests/unit/web/sentry-scrub.test.ts

@@ -39,7 +39,7 @@ describe("static filter lists", () => {
 });
 
 describe("buildWebBeforeSend", () => {
-  const baseEvent = (): Record<string, any> => ({
+  const baseEvent = (over: Record<string, any> = {}): Record<string, any> => ({
     request: { url: "http://192.168.0.4:1349/image/resize" },
     breadcrumbs: [{}],
     user: { id: "x" },
@@ -54,13 +54,13 @@ describe("buildWebBeforeSend", () => {
       ],
     },
     tags: { tool_id: "resize", drop_me: "x" },
+    ...over,
   });
 
   it("gates, strips, keeps react componentStack, redacts values", () => {
     const send = buildWebBeforeSend(() => true);
     const out = send(baseEvent(), { originalException: new TypeError("boom /Users/a/b") })!;
     expect(out.request).toBeUndefined();
-    expect(out.breadcrumbs).toBeUndefined();
     expect(out.user).toBeUndefined();
     expect(out.contexts.react.componentStack).toBe("at ToolPage");
     expect(out.contexts.device).toBeUndefined();
@@ -71,6 +71,23 @@ describe("buildWebBeforeSend", () => {
     expect(buildWebBeforeSend(() => false)(baseEvent(), {})).toBeNull();
   });
 
+  it("keeps the breadcrumb trail, redacting paths/urls and dropping data payloads", () => {
+    const send = buildWebBeforeSend(() => true);
+    const out = send(
+      baseEvent({
+        breadcrumbs: [
+          { message: "fetch https://host/user.png", category: "fetch", data: { url: "x" } },
+          { message: "open /Users/a/secret.pdf", category: "console", level: "warning" },
+        ],
+      }),
+      {},
+    )!;
+    expect(out.breadcrumbs).toEqual([
+      { message: "fetch <url>", category: "fetch" },
+      { message: "open <path>", category: "console", level: "warning" },
+    ]);
+  });
+
   it("falls back to type-only for non-native exceptions without a rebuild", () => {
     const send = buildWebBeforeSend(() => true);
     const custom = Object.assign(new Error("user secret"), { name: "WeirdLibError" });
@@ -78,9 +95,9 @@ describe("buildWebBeforeSend", () => {
     expect(out.exception.values[0].value).toBe("TypeError");
   });
 
-  it("enforces the 20-per-hour ceiling", () => {
+  it("enforces the 500-per-hour ceiling", () => {
     const send = buildWebBeforeSend(() => true);
-    for (let i = 0; i < 20; i++) expect(send(baseEvent(), {})).not.toBeNull();
+    for (let i = 0; i < 500; i++) expect(send(baseEvent(), {})).not.toBeNull();
     expect(send(baseEvent(), {})).toBeNull();
   });