docs(telemetry): document what Switch Console collects and why it is anonymous

[amaudruz]

Written for the Switch × InfoSec telemetry review, so the claim "our telemetry cannot be traced to a person" is evidenced somewhere durable rather than re-argued in chat.

What's here

docs/TELEMETRY.md — the evidence document:

• A complete real JSON payload for one event, so there's no ambiguity about what goes over the wire.
• Every event and every field, with example values taken verbatim from the source — including the full failure_reason enum per event, all 15 setting_key values, all 10 view_id values, install methods and providers.
• The three independent code-level mechanisms that make free text impossible to transmit (closed literal types + compile-time assertion, send-time allowlist, narrowing of all external values).
• The install identifier, and why no join key to an identity exists.
• The send path: app → our relay → Amplitude/Datadog.
• Client-IP requirements on the relay (not logged, not forwarded, Amplitude geo-enrichment off, not streamed to CloudTrail/Orca, rate limiting via a Bloom filter over a salted and rotated IP hash).
• The closing argument on non-traceability.

README.md — a short Telemetry section: data/example/purpose table, an explicit "what we never collect" list, where it goes, how to opt out, and a link to the full document.

Please check

• The relay requirements in §7 are marked [TO CONFIRM] — they describe the target state, verified against the Console source only. Someone with access to the relay's configuration needs to confirm them before the markers come off.
• Both documents describe telemetry as opt-in, matching the code today (default off, explicit consent, setting re-read per event). If the default changes, both need updating together.

🤖 Generated with Claude Code

[amaudruz]

Superseded — branched off a feature branch by mistake, so this carried 108 unrelated files. Reopened clean off main.