Fix Sentry build: disable telemetry, fix release version passing

- Disable Sentry Vite plugin telemetry (telemetry: false)
- Pass SENTRY_RELEASE as build-arg (not secret) since it's just the git sha
- Keep only SENTRY_AUTH_TOKEN as Docker secret

The release version was showing as *** because Docker secrets get masked
by GitHub Actions. Git sha is not sensitive — safe as a build arg.

The sourcemap warning from react-router is a known upstream issue (ships
without sourcemaps) and is harmless.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/journal/Dockerfile

@@ -14,12 +14,12 @@ COPY packages/db/package.json packages/db/
 RUN pnpm install --frozen-lockfile
 
 FROM base AS build
+ARG SENTRY_RELEASE
 COPY --from=deps /app/ ./
 COPY . .
 RUN --mount=type=secret,id=SENTRY_AUTH_TOKEN \
-    --mount=type=secret,id=SENTRY_RELEASE \
     SENTRY_AUTH_TOKEN="$(cat /run/secrets/SENTRY_AUTH_TOKEN 2>/dev/null)" \
-    SENTRY_RELEASE="$(cat /run/secrets/SENTRY_RELEASE 2>/dev/null)" \
+    SENTRY_RELEASE="$SENTRY_RELEASE" \
     pnpm --filter @trails-cool/journal build
 
 FROM base AS runtime

apps/journal/vite.config.ts

@@ -17,6 +17,7 @@ export default defineConfig({
       release: { name: process.env.SENTRY_RELEASE },
       sourcemaps: { filesToDeleteAfterUpload: ["./build/**/*.map"] },
       disable: !process.env.SENTRY_AUTH_TOKEN,
+      telemetry: false,
     }),
   ],
   resolve: {

apps/planner/Dockerfile

@@ -14,12 +14,12 @@ COPY packages/db/package.json packages/db/
 RUN pnpm install --frozen-lockfile
 
 FROM base AS build
+ARG SENTRY_RELEASE
 COPY --from=deps /app/ ./
 COPY . .
 RUN --mount=type=secret,id=SENTRY_AUTH_TOKEN \
-    --mount=type=secret,id=SENTRY_RELEASE \
     SENTRY_AUTH_TOKEN="$(cat /run/secrets/SENTRY_AUTH_TOKEN 2>/dev/null)" \
-    SENTRY_RELEASE="$(cat /run/secrets/SENTRY_RELEASE 2>/dev/null)" \
+    SENTRY_RELEASE="$SENTRY_RELEASE" \
     pnpm --filter @trails-cool/planner build
 
 FROM base AS runtime

apps/planner/vite.config.ts

@@ -19,6 +19,7 @@ export default defineConfig({
       release: { name: process.env.SENTRY_RELEASE },
       sourcemaps: { filesToDeleteAfterUpload: ["./build/**/*.map"] },
       disable: !process.env.SENTRY_AUTH_TOKEN,
+      telemetry: false,
     }),
   ],
   resolve: {