Strip PII from analytics event metadata before persistence

[phertyameen]

Description

Add a sanitization step in track-event.provider.ts that strips or hashes obviously sensitive fields (emails, wallet addresses in raw form) from the free-form metadata JSON before writing to AnalyticsEvent.

Why this matters

Analytics tables are often queried broadly by many roles; they shouldn't become an unintentional store of sensitive user data.

Files to touch

• backend/src/analytics/providers/track-event.provider.ts

Acceptance Criteria

• Known PII field names are stripped or hashed before insert
• Sanitization is covered by a unit test with a deliberately 'dirty' payload

Notes

This issue is part of the new analytics module effort (tracking, aggregation,
and reporting on player/game activity). Please keep new code inside
backend/src/analytics/ following the same module/controller/service/provider
layout used by existing modules (e.g. progress, streak, quests).