feat(error-tracking): PostHog autocapture + sourcemap upload

[AquiGorka]

Summary

Greenfield PostHog wiring (repo had no analytics module). Errors-only scope — no analytics-event capture, no opt-in UI (PostHog error tracking is treated as technical telemetry, not user tracking).

• src/lib/analytics.ts (NEW): array.js shim loader gated on IS_PRODUCTION && POSTHOG_KEY. Exports initAnalytics() + captureException(error, properties?).
• src/lib/config.ts: add posthogKey / posthogHost to DashboardConfig + matching const exports.
• src/app.ts: initAnalytics() before bootstrap.
• src/server.ts: CSP extends script-src with https://us-assets.i.posthog.com and the production connect-src with https://us.i.posthog.com. The repo's existing .map 404 blocker is unchanged.
• src/build.ts: flip sourcemap always-on for production builds.
• deploy.yml (testnet + mainnet): add POSTHOG_KEY env from secrets.POSTHOG_PROJECT_TOKEN, validate non-empty, write posthogKey + posthogHost into the generated config.js. After build, posthog-cli sourcemap inject + upload. aws s3 sync gains --exclude "*.map" so maps stay off Tigris.

Implements part of ClickUp task 86c8x4a3p "Add PostHog error tracking to all UI apps" (1 of 5 frontends — see also provider-console, council-console, moonlight-pay, browser-wallet).

Test plan

• deno task check clean
• deno task lint clean
• deno task fmt:check clean
• deno task test — 13 passed
• deno task build -- --production emits public/app.js (32 KB) + public/app.js.map (126 KB)
• posthog-cli sourcemap inject + upload --directory public/ succeeded locally; PostHog release network-dashboard@1edb565611db9c0d28f70779d79449ebff32b42a created
• Smoke-tested locally: ENVIRONMENT=production deno task serve on :3030 with a real project token in public/config.js, errors land in PostHog Errors dashboard with .ts-resolved stack frames
• After merge: confirm the testnet/mainnet deploy actions complete the Upload source maps to PostHog step successfully

Caveats

• Init config uses capture_exceptions: true (posthog-js v1.376+ renamed it from autocapture_exceptions). PostHog's older docs still reference the old name; capture_exceptions is the field actually read by the SDK.
• iac was updated separately to fan POSTHOG_PROJECT_TOKEN and POSTHOG_CLI_API_KEY to this repo as GH secrets.