feat(analytics): add consent-gated activation-funnel analytics via PostHog

Installs are up 615% but 7-day retention is ~0% and we had no analytics SDK
to see where users drop off. Adds a thin PostHog wrapper (src/lib/analytics.ts)
that tracks app_opened, connection_form_submitted, connection_attempted,
connection_succeeded/failed (with a coarse error_class, e.g. the known 401
auth bug), message_sent, and response_received.

PostHog was chosen over Aptabase for its GMS-free JS-only RN SDK (fine for
the F-Droid/no-Firebase build), EU-hosted/self-host option, and generous
free tier. Analytics shares the exact same consent flag as Sentry
(telemetry.ts now gates both) so zero network calls happen without explicit
opt-in.

Requires a new EXPO_PUBLIC_POSTHOG_KEY CI secret (wired into build.yml,
publish-fdroid.yml, publish-play-store.yml, and documented in
publish-app-store.yml alongside the existing Sentry secrets).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NJKAQ6HAikWGQK7PGZ5Y4E

app/connection/add.tsx

@@ -18,6 +18,7 @@ import type { ConnectionType } from "../../src/lib/types"
 import { probeConnection, shareReport } from "../../src/lib/diagnostics"
 import { captureDiagnostic } from "../../src/lib/sentry"
 import { parseUrl } from "../../src/lib/diagnostics-classify"
+import { AnalyticsEvent, track } from "../../src/lib/analytics"
 
 export default function AddConnectionScreen() {
   const colorScheme = useColorScheme()
@@ -67,6 +68,7 @@ export default function AddConnectionScreen() {
       return
     }
 
+    track(AnalyticsEvent.ConnectionFormSubmitted, { mode: "quick" })
     setIsConnecting(true)
 
     // Test connection first
@@ -127,6 +129,11 @@ export default function AddConnectionScreen() {
       return
     }
 
+    track(AnalyticsEvent.ConnectionFormSubmitted, { mode: "advanced" })
+    // Advanced mode saves directly without a pre-flight health check (see
+    // useConnections.addConnection), so unlike quick-connect there is no
+    // success/failure signal to report here — only that an attempt was made.
+    track(AnalyticsEvent.ConnectionAttempted)
     setIsConnecting(true)
     await addConnection(
       {