Post-merge follow-ups for product analytics (#1238) #1242

PR #1238 (squash-merged in 195ea11) restored product analytics with its test-plan checkboxes unchecked. This issue tracks the remaining verification and the explicitly deferred decisions so they don't get lost.

Verification

Checked against a production build of main @ 195ea11 (embedded frontend, not dev mode), observed via a local egress-logging proxy:

• Self-hosted default (no override): telemetry_enabled: false on /api/primo/info, zero outbound PostHog connections during boot
• Self-hosted opt-in (PRIMO_ENABLE_USAGE_STATS=true): telemetry_enabled: true; server heartbeat delivered to us.i.posthog.com on boot; posthog-js client initializes in the browser (request to us-assets.i.posthog.com observed)
• Hosted-mode flag (PRIMO_HOSTED_MODE=true): telemetry_enabled: true by default
• go test ./internal/ -run Stats passes (flag-matrix unit tests added with the PR)

Still outstanding:

• After the next release deploys to hosted instances: confirm telemetry_enabled: true on /api/primo/info of an actual hosted instance, and PostHog receives events for a real create → edit → publish → invite flow
• Spot-check a captured event in PostHog live view for properties that shouldn't be there (content, email, raw error). Note: the local verification above already sent a real instance_heartbeat (instance pXxhVStDX4c2BOXEy8zr, 2026-09-19) that can be used for this spot-check.
• Cut a release containing 195ea11 (analytics is currently on main only; no tag includes it)

Deferred decisions (parked during the PR, needed before EU/enterprise engagement)

• PostHog region: client (src/lib/PostHog.ts) and heartbeat (internal/stats.go) both hardcode https://us.i.posthog.com. PostHog has no region migration path, so if EU data residency will ever matter, this needs deciding before real data accumulates.
• GDPR legal basis for hosted default-on telemetry (legitimate interest vs consent) — affects whether default-on is defensible as-is.
• PostHog DPA / subprocessor listing — standard procurement ask.
• Self-hosted-operator-as-controller wording for the PRIMO_ENABLE_USAGE_STATS opt-in (what we tell operators their compliance obligation is when they flip it on).

Refs: ANALYTICS.md, #1238.