Add privacy-safe PostHog analytics foundation

[mergemaven11]

Summary

• preserve the existing Google Analytics integration
• add PostHog event ingestion using the BragStack PostHog project
• send only anonymous IDs and normalized route paths
• intentionally omit query strings, hashes, emails, names, brag content, evidence, and other user-authored career data
• keep analytics failures non-blocking

Why

This gives BragStack founder-level acquisition telemetry without enabling session replay or collecting sensitive career content.

Validation

Please run Frontend CI and Security CI on this exact PR head before merge.