Make BufferDash deployment ready

[1337lean]

Summary

• fix browser session reuse, server-side session duration, bot filtering, and pageview-based analytics dimensions
• complete retention cleanup for sessions and orphaned visitors
• add site-origin enforcement, strict production configuration validation, safer proxy handling, security headers, and loopback-only Docker exposure
• remove unused admin APIs and the unused site secret
• clarify tracker traffic-quality and runtime metric limitations
• add privacy-safe tool usage reporting, focused tests, and CI

Why

The pre-deployment review found correctness issues in session storage and bot filtering, misleading security/runtime framing, incomplete retention, and production defaults that could permit placeholder secrets or unnecessary network exposure. This prepares the first VPS deployment with safer defaults and more trustworthy analytics.

Validation

• npm run lint
• npm run typecheck
• npm test (8 tests)
• npm run build
• docker compose config --quiet
• docker compose build app migrate
• git diff --check