PostHog web analytics behind the first-party /stats proxy (Umami replacement, parallel-run)

[JSONbored]

Part of epic #8286 (Phase 2 — Analytics).

• Blocked by Provision a loopover-owned Posthog project for the hosted fleet #7875.

Current state

UI pageview analytics run on self-hosted Umami through a deliberately-hardened first-party path: apps/loopover-ui/src/lib/analytics-proxy.ts forwards POST /stats/api/send to the Umami instance under a strict route/method allowlist (its header documents why: never proxy mutable third-party JS as same-origin code; never become an open proxy onto the analytics host's admin API), and the UI sends a tiny local beacon rather than loading the remote tracker script.

Deliverables

• PostHog web analytics through the same first-party posture: posthog-js init pointed at our own origin (/stats-prefixed capture path), analytics-proxy.ts repointed/extended to forward the PostHog capture + static-asset routes it actually needs — allowlist stays load-bearing, nothing else forwarded. Mirror feat(ui): add PostHog web analytics, first-party proxied, alongside Umami metagraphed#7781 and fold in the fix(ui): harden the analytics proxy defensively; enable pageleave + native web vitals metagraphed#7804 hardening lessons up front (defensive proxy behavior, $pageleave enabled, native web-vitals capture) and the fix(ui): stop a background cache.put() rejection from 500ing the response metagraphed#7794 fix (a background cache.put() rejection must not 500 the response).
• Privacy posture preserved: cookieless/memory persistence decision made explicitly and documented (Umami today is cookieless — don't silently regress that).
• One shared posthog-js init module with the UI error-tracking sub-issue (whichever lands first owns it).
• Umami keeps running in parallel until its gated decommission sub-issue.
• Billing limit set on Product Analytics before enabling (shares the event pool with existing MCP telemetry).
• Tests: proxy allowlist (mirror the existing analytics-proxy tests), beacon/init gating.

Boundaries

• No replay here (own sub-issue). No Umami removal here (gated sub-issue).

Resources

• https://posthog.com/docs/web-analytics and https://posthog.com/docs/advanced/proxy/cloudflare
• feat(ui): add PostHog web analytics, first-party proxied, alongside Umami metagraphed#7781, fix(ui): harden the analytics proxy defensively; enable pageleave + native web vitals metagraphed#7804, fix(ui): stop a background cache.put() rejection from 500ing the response metagraphed#7794

[linear-code]

JSO-5738