fix: feat: basic analytics funnel tracking for launch readiness (#1101)

Add self-hosted Umami analytics to replace the third-party cloud.umami.is
tracker. Creates @harb/analytics package with typed event helpers and
instruments the conversion funnel: CTA clicks (landing), wallet connect,
swap initiated, and stake created (web-app).

- Add Umami Docker service sharing existing postgres (separate DB)
- Add Caddy /analytics route to proxy Umami dashboard
- Configure via VITE_UMAMI_URL and VITE_UMAMI_WEBSITE_ID env vars
- Document setup and funnel events in docs/ENVIRONMENT.md

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/ENVIRONMENT.md

@@ -16,6 +16,7 @@ Docker Compose services (in startup order):
 | **webapp** | Staking app (Vue 3) | 5173 | HTTP response |
 | **txn-bot** | Automated `recenter()` and `payTax()` upkeep ([services/txnBot/](../services/txnBot/)) | 43069 | Process alive |
 | **caddy** | Reverse proxy / TLS | 80/443 | — |
+| **umami** | Self-hosted analytics (Umami) | 3000 | HTTP /api/heartbeat |
 | **otterscan** | Block explorer | 5100 | — |
 
 ## txnBot Service
@@ -119,6 +120,7 @@ docker inspect landing --format '{{.NetworkSettings.Networks.harb_harb-network.I
 - **Ponder GraphQL:** `http://localhost:42069/graphql`
 - **Anvil RPC:** `http://localhost:8545`
 - **txnBot status:** `http://localhost:43069/status`
+- **Umami analytics:** `http://localhost:3000` (default login: `admin` / `umami`)
 
 ## Resource Notes
 
@@ -140,6 +142,39 @@ For testing login: `lobsterDao`, `test123`, `lobster-x010syqe?412!`
 | `VITE_KRAIKEN_ADDRESS` | from `deployments-local.json` | via `contracts.env` + entrypoint | Override KRK token address. |
 | `VITE_STAKE_ADDRESS` | from `deployments-local.json` | via `contracts.env` + entrypoint | Override Stake contract address. |
 | `VITE_DEFAULT_CHAIN_ID` | auto-detected (31337 on localhost) | — | Force the default chain. |
+| `VITE_UMAMI_URL` | unset | via env | Full URL to Umami `script.js` (e.g. `https://analytics.kraiken.org/script.js`). Omit to disable analytics. |
+| `VITE_UMAMI_WEBSITE_ID` | unset | via env | Umami website ID (UUID). Required alongside `VITE_UMAMI_URL`. |
+
+## Analytics (Umami)
+
+Self-hosted [Umami](https://umami.is/) provides privacy-respecting funnel analytics with no third-party tracking. The `umami` Docker service shares the `postgres` instance (separate `umami` database created by `containers/init-umami-db.sh`).
+
+### Setup
+
+1. Start the stack — Umami comes up automatically.
+2. Open `http://localhost:3000` and log in (default: `admin` / `umami`). Change the password on first login.
+3. Add a website in Umami and copy the **Website ID** (UUID).
+4. Set the env vars before starting landing/webapp:
+   ```bash
+   export VITE_UMAMI_URL=http://localhost:3000/script.js
+   export VITE_UMAMI_WEBSITE_ID=<your-website-id>
+   ```
+   For staging/production behind Caddy, use the `/analytics/script.js` path instead.
+
+### Tracked funnel events
+
+| Event | App | Trigger |
+|-------|-----|---------|
+| `cta_click` | landing | User clicks a CTA button (label in event data) |
+| `wallet_connect` | web-app | Wallet connected for the first time |
+| `swap_initiated` | web-app | User submits a buy or sell swap (direction in event data) |
+| `stake_created` | web-app | Stake position successfully created |
+
+Page views are tracked automatically by the Umami script on every route change.
+
+### Production deployment
+
+On `harb-staging`, set `VITE_UMAMI_URL` and `VITE_UMAMI_WEBSITE_ID` in the environment and configure `UMAMI_APP_SECRET` to a strong random value. The Caddy route `/analytics*` proxies to the Umami container.
 
 ## Contract Addresses