Google analytics integration.

Sentry.io integration.
Vince integration.
Region-scoped consent (denied-by-default in EU/EEA/UK/CH, granted elsewhere, DPDP-friendly notice)

Dockerfile

@@ -21,6 +21,19 @@ FROM node:${NODE_VERSION}-trixie-slim AS builder
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
+
+# Analytics ids are baked into the client bundle at build time (Vite
+# statically replaces import.meta.env.VITE_*). The Makefile passes them
+# from the deploy machine's .env — empty values cleanly disable each tool.
+ARG VITE_GA4_MEASUREMENT_ID=""
+ARG VITE_PLAUSIBLE_DOMAIN=""
+ARG VITE_SENTRY_DSN=""
+ARG VITE_SENTRY_RELEASE=""
+ENV VITE_GA4_MEASUREMENT_ID=$VITE_GA4_MEASUREMENT_ID \
+    VITE_PLAUSIBLE_DOMAIN=$VITE_PLAUSIBLE_DOMAIN \
+    VITE_SENTRY_DSN=$VITE_SENTRY_DSN \
+    VITE_SENTRY_RELEASE=$VITE_SENTRY_RELEASE
+
 RUN npm run build
 
 # ── runner ──────────────────────────────────────────────────
@@ -53,6 +66,10 @@ ENV NODE_ENV=production \
     PB_URL=http://127.0.0.1:8090 \
     SHOPIFY_TOKEN_CACHE=/app/pb_data/shopify-token.json
 
+# Release id for server-side Sentry (matches the client bundle's baked value).
+ARG SENTRY_RELEASE=""
+ENV SENTRY_RELEASE=$SENTRY_RELEASE
+
 # Install production dependencies only (react + @tanstack/* — no vite,
 # tailwind, eslint or typescript ship in the runtime image).
 COPY package.json package-lock.json ./