feat: add PostHog, move Plausible to v4, and drop Sentry session replay

PostHog loads after the page is idle through a same-origin /ingest proxy and follows the signed-in Convex user. Plausible uses the per-site script through a /pa proxy. Sentry keeps errors and traces only. Pages load only the @spoon/ui modules they import, and client code reads public env from publicEnv.ts so zod stays out of the browser. Both analytics integrations stay off until their env is set in Infisical prod.

apps/next/src/publicEnv.ts

@@ -0,0 +1,30 @@
+import type { env } from '@/env';
+
+type PublicEnv = Pick<
+  typeof env,
+  | 'NEXT_PUBLIC_SITE_URL'
+  | 'NEXT_PUBLIC_CONVEX_URL'
+  | 'NEXT_PUBLIC_PLAUSIBLE_SRC'
+  | 'NEXT_PUBLIC_POSTHOG_KEY'
+  | 'NEXT_PUBLIC_POSTHOG_HOST'
+  | 'NEXT_PUBLIC_SENTRY_DSN'
+>;
+
+// Empty strings count as unset, matching `emptyStringAsUndefined` in env.ts.
+const read = (value: string | undefined) => (value === '' ? undefined : value);
+
+// The browser-side NEXT_PUBLIC_* values for client components and
+// instrumentation-client. Next inlines each literal `process.env.X` at build
+// time, and env.ts has already validated them by then (next.config.js imports
+// it), so reading them here keeps zod and the env schema out of every
+// visitor's first download. Server code keeps importing `@/env`.
+/* eslint-disable no-restricted-properties -- the one sanctioned client-side reader, see AGENTS.md */
+export const publicEnv = {
+  NEXT_PUBLIC_SITE_URL: read(process.env.NEXT_PUBLIC_SITE_URL),
+  NEXT_PUBLIC_CONVEX_URL: read(process.env.NEXT_PUBLIC_CONVEX_URL),
+  NEXT_PUBLIC_PLAUSIBLE_SRC: read(process.env.NEXT_PUBLIC_PLAUSIBLE_SRC),
+  NEXT_PUBLIC_POSTHOG_KEY: read(process.env.NEXT_PUBLIC_POSTHOG_KEY),
+  NEXT_PUBLIC_POSTHOG_HOST: read(process.env.NEXT_PUBLIC_POSTHOG_HOST),
+  NEXT_PUBLIC_SENTRY_DSN: read(process.env.NEXT_PUBLIC_SENTRY_DSN),
+} as PublicEnv;
+/* eslint-enable no-restricted-properties */