feat: add PostHog, move Plausible to v4, and drop Sentry session replay

PostHog loads after the page is idle through a same-origin /ingest proxy and follows the signed-in Convex user. Plausible uses the per-site script through a /pa proxy. Sentry keeps errors and traces only. Pages load only the @spoon/ui modules they import, and client code reads public env from publicEnv.ts so zod stays out of the browser. Both analytics integrations stay off until their env is set in Infisical prod.

AGENTS.md

@@ -74,6 +74,12 @@
   read-only `spoon-ci` machine identity (Gitea secrets `INFISICAL_CLIENT_ID` and
   `INFISICAL_CLIENT_SECRET`), and hands the result to the scripts as
   `CI_ENV_FILE`. `scripts/export-env` refuses to run in CI.
+- Plausible (`NEXT_PUBLIC_PLAUSIBLE_SRC`, the per-site script) loads through a
+  same-origin `/pa` proxy and PostHog (`NEXT_PUBLIC_POSTHOG_KEY`/`_HOST`) through
+  `/ingest`, after the page is idle. Both stay off when unset. Session replay comes
+  from PostHog; Sentry carries errors and traces only. Client code reads public env
+  from `@/publicEnv`, and `packages/ui/src/index.tsx` holds re-exports only so
+  `optimizePackageImports` can load just the modules a page imports.
 - A push to `main` builds the images, syncs the Convex env, deploys Convex, pushes
   the images, and asks the VPS to redeploy `podman-spoon.service`
   (`ssh [email protected] spoon`). A push to `main` is a production deploy.