Add managed content and keyboard usage insights

Introduce versioned official content workflows and privacy-safe keyboard analytics, while preventing repeat DeviceCheck sign-ins from incorrectly restricting eligible accounts.

docs/PRODUCT_ANALYTICS.md

@@ -8,7 +8,7 @@ from billing, provider execution and immutable credit ledgers.
 Never send or persist:
 
 - audio or audio-derived content;
-- keyboard input, prompts, context, transcripts or model output;
+- raw keyboard input, keystrokes, prompts, context, transcripts or model output;
 - Apple subjects, email addresses, names, tokens, API keys or provider
   credentials;
 - arbitrary property names or free-form text.
@@ -18,6 +18,8 @@ the identifier supplied by the client. Event DTO string representations are
 redacted. Product analytics rows linked to an account are deleted with that
 account. Anonymous installations that never link to an account are retained for
 90 days and are eligible for scheduled deletion in a later operational job.
+Per-installation keyboard usage summaries are retained for at most 90 days
+regardless of account linkage.
 
 ## Ingestion API
 
@@ -40,6 +42,38 @@ account. Anonymous installations that never link to an account are retained for
 The successful response reports `accepted` and `replayed` event counts. It does
 not return account or installation identifiers.
 
+## Keyboard usage summaries
+
+`POST /v1/analytics/keyboard-usage` accepts 1 to 50 finalized UTC-day
+summaries. Authentication, installation hashing, account linking, atomic
+batching and replay semantics match the event ingestion API.
+
+- Language classification and counting happen on-device.
+- Only text manually committed by OSGKeyboard is counted. Voice transcripts,
+  pasted text, AI-generated output and text entered with another keyboard are
+  excluded.
+- Chinese counts Unicode characters classified with the Han script. English
+  counts Latin letters. Digits, punctuation and Emoji are counted as `other`.
+- Pinyin composition keystrokes are not counted as English; only the final
+  committed text is classified.
+- An input session is one keyboard activation containing at least one
+  committed character.
+- Chinese-only sessions contain Chinese but no English; English-only sessions
+  contain English but no Chinese; mixed sessions contain both. Other
+  characters may occur in any of those sessions. Other-only sessions contain
+  neither Chinese nor English.
+- The four language-session counters must sum to `inputSessionCount`, and the
+  total committed character count must be at least the session count.
+- Each installation may submit only one immutable summary per UTC date.
+- Accepted dates are from 35 days ago through yesterday. Current-day partial
+  summaries are rejected.
+- Raw text, per-keystroke events, surrounding context, host application
+  identifiers and free-form properties are never accepted.
+
+The client should keep counters and the finalized outbox in the shared App
+Group so either the containing app or keyboard extension can deliver them.
+Retries must reuse the stored `clientSummaryId`.
+
 ## Event catalog
 
 ### Lifecycle events
@@ -186,6 +220,8 @@ The admin analytics endpoints combine:
 - settled credit usage for managed AI counts and credit consumption;
 - accounts, StoreKit and referrals for registration, monetization and referral
   outcomes.
+- daily keyboard summaries for privacy-minimized Chinese and English input
+  activity, character volume and input sessions.
 
 Metric formulas are defined in
 [`ANALYTICS_METRICS_DICTIONARY.md`](ANALYTICS_METRICS_DICTIONARY.md).