Add privacy-safe product analytics

Establish an idempotent analytics pipeline and internal decision dashboard while keeping event metadata allowlisted and account deletion enforceable.

docs/ARCHITECTURE.md

@@ -26,6 +26,10 @@ It does not replace the app's local ASR, BYOK provider access, or iCloud sync.
 - `integrity` evaluates DeviceCheck and App Attest evidence.
 - `gateway` proxies Volcengine ASR and DeepSeek text requests.
 - `inviteweb` serves the first-party invitation landing page.
+- `analytics` accepts a strict allowlist of product event metadata and links a
+  pseudonymous installation to an account only when a valid session is present.
+- `admin/stats` combines accepted product events with authoritative billing,
+  StoreKit, account, and referral aggregates for the internal dashboard.
 
 Modules communicate through narrow ports. Provider clients, Apple clients,
 integrity clients, clocks, token generators, and repositories are replaceable in
@@ -60,7 +64,10 @@ tests.
   claims required for replay protection.
 - Usage metadata contains feature, model, metering units, latency, status, and
   rate-card version.
+- Product events contain enums, release versions, timestamps, and duration
+  buckets only. Installation UUIDs are stored as SHA-256 digests.
 - Operational logs use request IDs and internal opaque IDs, never Apple subjects
   or bearer credentials.
-- Account deletion revokes credentials and removes user-linked records. Only
-  non-identifying aggregate service metrics may remain.
+- Account deletion revokes credentials and cascades through linked product
+  installations and events. Only non-identifying aggregate service metrics may
+  remain.