feat(web): add Umami analytics with first-party proxy

[chtnnh]

Supplement Cloudflare Web Analytics with self-hosted Umami via /w/a rewrites (tracker, recorder, API) for pageviews, replays, and heatmaps. Also fix pre-commit Biome to lint staged files on new branches.

Know-Code-Verified: 879c797a0997efb7455746c04878fea20604197b0e2f663c944e27cf024515ce

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
together-web	Ready	Preview	Aug 11, 2026 6:37am

[cursor]

PR Summary

Low Risk
Analytics and CSP/rewrite configuration only; no auth or data-model changes, and Umami stays off without env vars.

Overview
Adds self-hosted Umami alongside existing Cloudflare Web Analytics: page views, optional replays/heatmaps, loaded through first-party paths (/w/a.js, /w/a/r.js, /w/a/api/*) rewritten to UMAMI_ORIGIN so trackers are less likely to be blocked.

UmamiAnalytics mounts in the root layout when NEXT_PUBLIC_UMAMI_WEBSITE_ID and NEXT_PUBLIC_APP_URL are set; CSP gains frame-ancestors for the Umami origin for heatmap previews. Privacy policy text is updated to describe Umami (including proxy and optional replays). Pre-commit runs Biome on --staged when the index has changes, otherwise --changed, fixing lint on new branches without origin/main.

^{Reviewed by Cursor Bugbot for commit 0d03305. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0d03305. Configure here.}