security: allowlist the publishable PostHog token for gitleaks

.gitleaks.toml allowlists the exact phc_ literal (write-only client key,
public by PostHog's design; #1193) — regex-based so history scans pass
too — plus gitleaks:allow inline markers. phx_ personal keys stay banned;
the guard test still pins the literal to the two canonical files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitleaks.toml

@@ -0,0 +1,18 @@
+# Gitleaks config — extends the default ruleset.
+#
+# The ONLY sanctioned allowlist entry is PostHog's publishable project token
+# (owner decision 2026-07-20, #1193). Per PostHog's docs the `phc_` project
+# token is a write-only client key with "no access to your private data" —
+# it ships in every release binary and every official PostHog SDK snippet.
+# It is NOT a credential. Personal keys (`phx_`) remain fully banned.
+# `tests/test_no_committed_analytics_token.py` separately pins the literal to
+# exactly two canonical files and requires both to carry the same value.
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "PostHog publishable write-only project token (public by design; #1193)"
+regexes = [
+  '''phc_v5wMjnYMPMaEcRNLRKQsTYCzPaYWh7wcHPhXNkNajVf9''',
+]

backend/core/analytics.py

@@ -54,7 +54,7 @@ _OFF_VALUES = {"1", "true", "yes", "on"}
 #: desktop shell; developers can point at their own project) always wins.
 #: Committed-token guard: tests/test_no_committed_analytics_token.py allows a
 #: `phc_` literal in exactly this file and frontend/src/utils/analytics.ts.
-_PUBLIC_PROJECT_TOKEN = "phc_v5wMjnYMPMaEcRNLRKQsTYCzPaYWh7wcHPhXNkNajVf9"
+_PUBLIC_PROJECT_TOKEN = "phc_v5wMjnYMPMaEcRNLRKQsTYCzPaYWh7wcHPhXNkNajVf9"  # gitleaks:allow — publishable write-only key (#1193)
 _DEFAULT_HOST = "https://eu.i.posthog.com"
 
 #: The ONLY property keys that may leave this machine. Anything else is dropped.

frontend/src/utils/analytics.ts

@@ -41,7 +41,7 @@ import type { PostHog } from 'posthog-js';
  * tests/test_no_committed_analytics_token.py pins that a `phc_` literal may
  * live in exactly this file and backend/core/analytics.py.
  */
-const PUBLIC_PROJECT_TOKEN = 'phc_v5wMjnYMPMaEcRNLRKQsTYCzPaYWh7wcHPhXNkNajVf9';
+const PUBLIC_PROJECT_TOKEN = 'phc_v5wMjnYMPMaEcRNLRKQsTYCzPaYWh7wcHPhXNkNajVf9'; // gitleaks:allow — publishable write-only key (#1193)
 const POSTHOG_TOKEN: string =
   (import.meta.env?.VITE_POSTHOG_KEY as string) || PUBLIC_PROJECT_TOKEN;
 const POSTHOG_HOST: string =