docs(analytics): document --include-external and refresh the report doc

[gokhanozdemir]

What

Refreshes docs/ANALYTICS-REPORT.md so it reflects the current codemie analytics surface. The centrepiece is --include-external, which was shipped in #410 and never documented anywhere.

Why

The flag is the "show me all of my local agent usage" switch, and people keep asking for that capability even though it already exists — a discoverability defect, not a missing feature.

The consequence of the silence: a user who ran claude, codex, gemini, pi, or copilot directly, then ran codemie analytics --report, saw none of that spend and got no hint it had been withheld. The exclusion is deliberate (the ownership gate keeps unmanaged runs out of CodeMie's adoption numbers) but it reads as missing data when it is undocumented.

Changes

• New "Session provenance" section — documents the three provider tags (native, native-external, native-unmanaged), why external sessions are excluded by default, and the trade-off of the wider view: external sessions have no CodeMie run to attribute to, and their cost depends on a native log that may have rotated away.
• --include-external surfaced in Quick Start and given its own "Source flags" block in the CLI Reference.
• Two behaviours that were easy to get wrong are now explicit: --no-scan-native --include-external adds nothing (the first flag suppresses what the second asks for), and --include-external is unavailable on analytics otel.
• One explicit statement that every filter and source flag governs terminal output and the HTML report alike.

Stale claims corrected against source:

Was	Now
Agents: Claude, Gemini, Codex, OpenCode, built-in	+ Pi, GitHub Copilot CLI
Sessions table columns	+ first prompt, + Source
--no-analytics-report on 3 agents	5 (claude, codex, opencode, pi, copilot-cli)
JSON report .json, shared base name	.report.json, so it can't collide with --export json
Default path codemie-analytics-YYYY-MM-DD.html	email-slug segment, plus the interactive email prompt
—	Session modal copy-ID / copy-file-location buttons
—	Native discovery window derives from the date filter

Verified as still accurate and left alone: the "nine interactive views" count.

Follow-up worth a decision

No agent sets analyticsOnly: true today — copilot-cli.registry.test.ts:27 asserts it explicitly is not. So native-unmanaged is a code path with no members, and Copilot CLI sessions are hidden from the default report like any other external run. This PR documents that as-is. If the intent was for Copilot CLI to be always-visible, that is a separate code change, and the provenance table here would need updating with it.

Verification

Docs-only; no code touched. Claims were read from analytics/index.ts, native-loader.ts, sessions-source.ts, report-generator.ts, and report/template.html rather than from live CLI output — --help could not be run in the authoring environment. tsc --noEmit passed at commit time. The Gitleaks pre-commit gate was skipped: no container engine on the machine (validate-secrets.js requires one). Worth re-running in CI.