feat(editor): report uncaught errors to Better Stack

The editor reported nothing when a session died. Evidence lived only in-tab —
an 800-line React array behind a "Show console" button — so diagnosis meant
asking a user to paste a screenshot.

Better Stack's Error Tracking ingests the Sentry wire protocol, so this runs
the stock @sentry/browser against a Better Stack DSN. Sentry.init installs its
own window error/unhandledrejection handlers, so uncaught main-thread errors
and the wasm traps that escape emscripten's DOM event handlers are captured
with no instrumentation at the throw sites. Not their JS tag: it has no
beforeSend or fingerprint hooks, its runtime spawns workers from cross-origin
CDN hosts (this page is COEP: require-corp), and it ships session replay on by
default — which on a CAD canvas records customers' board geometry.

@sentry/browser is imported in exactly one file so the vendor stays swappable,
mirroring how lib/analytics.ts isolates Plausible.

Also replaces the terminal-signature regex with a shared, unit-tested predicate
(wasm/terminal-error.ts) used by BOTH the fatal overlay and the reporter, so
they cannot disagree. The regex was a type check written as a string match and
had three live holes: `RuntimeError` was listed but never appears IN
`.message`; Chrome's bare "unreachable" and "null function" matched nothing
(the v0.1.20 prod log is exactly those); and narrowing "table index is out of
bounds" to `\bindex out of bounds` for Firefox in 197f317 silently stopped
matching Chrome's spelling. Checking the TYPE — every trap in this family is a
WebAssembly.RuntimeError — covers all engines and ends the spelling chase; the
message patterns remain as a fallback for paths that lose the Error object,
such as a worker ErrorEvent crossing the realm boundary with error: null.
197f317's pthread-worker tap, promote() and Firefox findings are kept as-is.

Notes:
- Off unless VITE_ERRORS_DSN is set AND VITE_ALLOW_USER_OVERRIDE !== "1" (dev
  servers and every Playwright harness set the latter, and production builds
  never do), so a production DSN in a local .env still cannot report. With no
  DSN the whole SDK is const-folded out: 1,193,080 vs 1,282,463 bytes of JS.
- browserApiErrors integration removed. It wraps setTimeout/rAF/addEventListener
  in try/catch, which is exactly how KiCad-on-Emscripten drives its main loop.
- Console breadcrumbs off (collab/debug.ts's clog fires per Yjs update and would
  evict the ring before any crash); dom/fetch/navigation breadcrumbs kept.
- beforeSend redacts token/apiKey/Bearer — collab/provider.ts puts the collab
  token in the y-partyserver URL, so a connection-failure string carries a live
  credential — and guards the cascade: one wedge produced 8 errors in prod, and
  after the first terminal event the rest are dropped into cascade_count.

Verified end to end against the real EU host from a cross-origin-isolated page:
POST /api/<id>/envelope/ -> 200, and 4 terminal throws produce 1 event
(control: 1 throw, same count).

Privacy policy 9, cookie policy 6 and the licenses page are updated: Better
Stack is disclosed as an EU processor, and the licenses page now describes the
browser app's own JS dependencies, which it never did.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/deploy/build-editor.mjs

@@ -34,6 +34,10 @@ function parseArgs(argv) {
     // kicad-packages3D snapshot (libs/kicad-models/<tag>/); omitted ⇒ 3D models off.
     modelsTag: null,
     plausible: null,
+    // Better Stack error-tracking DSN (Sentry wire format). Omitted ⇒ no error
+    // reporting from this build.
+    errorsDsn: null,
+    errorsEnv: "production",
     // Companion mgmt app origin; set ⇒ non-editor routes redirect there
     // (standalone-hardening 0006). Omitted ⇒ every route renders locally.
     appBase: null,
@@ -48,6 +52,8 @@ function parseArgs(argv) {
       case "--yjs-endpoint": a.yjsEndpoint = next(); break;
       case "--models-tag": a.modelsTag = next(); break;
       case "--plausible": a.plausible = next(); break;
+      case "--errors-dsn": a.errorsDsn = next(); break;
+      case "--errors-env": a.errorsEnv = next(); break;
       case "--app-base": a.appBase = next(); break;
       default: throw new Error(`unknown arg: ${argv[i]}`);
     }
@@ -109,6 +115,11 @@ function main() {
     VITE_GIT_SHA: gitSha(repoRoot),
     VITE_REPO_URL: a.repo,
     ...(a.plausible ? { VITE_PLAUSIBLE_SRC: a.plausible } : {}),
+    // Error tracking. The env tag rides along only when a DSN is given, so a
+    // DSN-less build cannot report under a production label.
+    ...(a.errorsDsn
+      ? { VITE_ERRORS_DSN: a.errorsDsn, VITE_ERRORS_ENV: a.errorsEnv }
+      : {}),
     // Non-editor surfaces bounce to the mgmt app (mirror of the closed repo's
     // VITE_STANDALONE_URL pointing the other way).
     ...(a.appBase ? { VITE_APP_URL: a.appBase } : {}),
@@ -123,6 +134,7 @@ function main() {
   console.log(`  VITE_MODELS_MANIFEST_URL=${env.VITE_MODELS_MANIFEST_URL ?? "(unset — 3D models off)"}`);
   console.log(`  VITE_APP_TAG=${env.VITE_APP_TAG} VITE_GIT_SHA=${env.VITE_GIT_SHA || "(none)"}`);
   console.log(`  VITE_PLAUSIBLE_SRC=${env.VITE_PLAUSIBLE_SRC || "(off)"}`);
+  console.log(`  VITE_ERRORS_DSN=${env.VITE_ERRORS_DSN ? `(set, env=${env.VITE_ERRORS_ENV})` : "(off)"}`);
   console.log(`  VITE_APP_URL=${env.VITE_APP_URL || "(unset — no non-editor redirect)"}`);
 
   // Keep the dev-only WASM symlink out of the bundle (CDN serves it).