Add privacy-safe product analytics

Establish an idempotent analytics pipeline and internal decision dashboard while keeping event metadata allowlisted and account deletion enforceable.

README.md

@@ -8,7 +8,10 @@ Kotlin 2.4.10 / Ktor 3.5.2 managed AI gateway and invitation page.
 - Volcengine SAUC v3 ASR over WebSocket with a strict binary frame codec.
 - Credit reservation, settlement, release, identity, grant, and metadata persistence ports.
 - Apple DeviceCheck trial enforcement and App Attest attestation/assertion validation.
-- Bilingual invitation page at `GET /i/{code}` with no analytics, tracking, or fingerprinting.
+- Bilingual invitation page at `GET /i/{code}` with no third-party analytics,
+  tracking scripts, or fingerprinting.
+- Privacy-minimized, idempotent product event ingestion and an internal growth,
+  retention, AI usage, monetization, and referral dashboard.
 - Flyway migrations for provider metadata, metered usage, gateway grants, and integrity state.
 
 Prompts, audio, transcripts, and provider response bodies are never sent to the usage persistence port.
@@ -26,6 +29,7 @@ Application logging must also keep request/response body logging disabled.
 - `POST /v1/integrity/assert`
 - `POST /v1/auth/apple`
 - `POST /v1/auth/refresh`, `POST /v1/auth/logout`
+- `POST /v1/analytics/events`
 - `GET/DELETE /v1/account`
 - `POST /v1/apple/events`
 - `GET /v1/credits/{balance|ledger|rates}`
@@ -34,6 +38,7 @@ Application logging must also keep request/response body logging disabled.
 - `GET /i/{code}`
 - `GET /.well-known/apple-app-site-association`
 - `GET /apple-app-site-association`
+- `GET /v1/admin/analytics` through the private mTLS-protected admin edge
 
 See `docs/openapi.yaml` for request limits and response formats.
 
@@ -298,9 +303,13 @@ Gateway tests cover account-scoped replay exclusion, cross-account isolation, pr
 settlement pending behavior, reconciliation, whole-call timeout, forged audio duration, malformed SAUC
 sequences, and final-frame-only duration.
 
-The MySQL Testcontainers suite validates all migrations, account-deletion cascades, stale access-token
-rejection, real InnoDB concurrent balance locking, and exactly-once referral rewards. It is automatically
-skipped when Docker is unavailable; CI requires Docker and runs it on every build.
+The MySQL Testcontainers suite validates all migrations, account-deletion
+cascades (including linked analytics events), stale access-token rejection, real
+InnoDB concurrent balance locking, and exactly-once referral rewards. Analytics
+tests additionally cover event validation, idempotent replay, conflict handling,
+offline timestamps, and privacy-minimized responses. It is automatically
+skipped when Docker is unavailable; CI requires Docker and runs it on every
+build.
 
 ## Staged acceptance