Google analytics integration.

Sentry.io integration.
Vince integration.
Region-scoped consent (denied-by-default in EU/EEA/UK/CH, granted elsewhere, DPDP-friendly notice)

ansible/roles/analytics/defaults/main.yaml

@@ -0,0 +1,4 @@
+---
+# vince_container / vince_port live in ansible/vars/default.yml (the Caddy
+# template needs them at play level).
+vince_image: vinceanalytics/vince:latest

ansible/roles/analytics/tasks/main.yaml

@@ -0,0 +1,28 @@
+---
+# Self-hosted first-party analytics (Vince — Plausible-protocol, single
+# binary). Only reachable on the docker network: Caddy proxies /stats/*
+# on the www host to this container, so browser requests stay first-party.
+- name: Pull Vince image
+  docker_image:
+    name: "{{ vince_image }}"
+    source: pull
+    state: present
+    force_source: "{{ vince_image_force_update | default(false) }}"
+
+- name: Ensure Vince data directory exists
+  file:
+    path: "{{ host_directory }}/vince_data"
+    state: directory
+    owner: "1000"
+    group: "1000"
+
+- name: Create Vince container
+  docker_container:
+    name: "{{ vince_container }}"
+    image: "{{ vince_image }}"
+    state: started
+    restart_policy: "unless-stopped"
+    volumes:
+      - "{{ host_directory }}/vince_data:/data"
+    networks:
+      - name: "{{ docker_network }}"