feat(analytics): replace Plausible with Google Analytics behind a consent bar

[datlechin]

Replaces self-hosted Plausible with Google Analytics 4 (G-FG4YV1QXYN) on the marketing site. The account portal makes the same switch in TableProApp/license#85, and the two must ship together.

Consent

GA4 sets _ga and _ga_<ID>, which need permission first in the EEA and UK, so the tag loads in Consent Mode. The head script's order is the contract, and AnalyticsConsentTest pins it by position:

1. gtag('consent', 'default', …) with every storage type denied.
2. If localStorage['tablepro:analytics-consent'] === 'granted', analytics_storage is granted.
3. Only then gtag('config'), so a returning reader's first page view carries its cookies.

Until the reader allows it, GA gets one cookieless ping per page and nothing is stored on the device. ad_storage, ad_user_data and ad_personalization are never granted.

The bar

• Allow and Decline are the same button at the same weight. A filled Allow next to an outlined Decline is the nudge regulators single out.
• It renders only after hydration, because SSR can't see localStorage. It also renders only when gtag exists, so dev and staging never show it.
• Bottom-left, clear of Crisp. Crisp's launcher measured 54px square, 14px from the corner on a phone, so on phones the bar leaves 5.5rem on the right.
• Consent can be withdrawn. "Cookie settings" in the footer and a button in /privacy#cookies reopen the bar. Declining after allowing deletes the _ga cookies. consent.test.ts runs this against a fake browser and checks the exact cookie writes.

The account portal carries a copy of the tag, the bar and consent.ts under the same key, so one answer covers both apps. docs/architecture.md has a new "Analytics and consent" section on that contract.

Events and privacy

download_click, checkout_started and newsletter_signup_clicked keep their names and parameters, now sent through gtag.

/privacy no longer calls analytics cookie-less. It now:

• names Google Analytics as a processor
• lists _ga / _ga_<ID> with consent as the lawful basis
• lists the consent key and the portal's tablepro-session / XSRF-TOKEN cookies
• covers the US transfer under the Data Privacy Framework and a retention of at most 14 months

Before merging

• Add GOOGLE_ANALYTICS_ID=G-FG4YV1QXYN to /var/www/tablepro.app/.env. PLAUSIBLE_* can go. The deploy rebuilds the config cache because config/ changed, so the value must already be there.
• Merge together with TableProApp/license#85.

After merging (GA admin)

• Register location, platform, tier, cycle and source as event-scoped custom dimensions, or the event parameters won't show in reports.
• Set data retention to 14 months, to match /privacy.
• Data redaction: add the query parameters signature, expires, token, email, order as a second safeguard behind the portal's own redaction.
• Keep enhanced measurement's "page changes based on browser history events" on. It counts Inertia navigations.

Not in this PR

• Crisp is live and sets its own cookies, which /privacy doesn't list.
• tablepro:attribution is still written without consent.

Testing

• php artisan test --compact: 241 passed, including the 9 new tests in AnalyticsConsentTest.
• npm run test:js: 26 passed, including 7 new in consent.test.ts.
• tsc --noEmit clean.
• In headless Chrome, with a fake ID:
  • no cookies before consent
  • _ga and _ga_* after Allow
  • on reload, consent:update sits before config in the dataLayer
  • Cookie settings then Decline removes both cookies
  • no hydration errors