Sentry improvements: context, tracing, source maps, privacy manifest

- Set Sentry user context (id, username) in Journal root for all routes
- Tag Planner errors with session_id
- Use reactRouterV7BrowserTracingIntegration for route-aware traces
- Hidden source maps (no sourceMappingURL in bundles, .map deleted after
  upload to Sentry)
- Privacy manifest at /privacy documenting all data collection
- robots.txt blocking all bots on both apps
- Suppress i18next promotional console log

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openspec/changes/sentry-improvements/specs/infrastructure/spec.md

@@ -0,0 +1,24 @@
+## MODIFIED Requirements
+
+### Requirement: Sentry error tracking
+The system SHALL enrich Sentry events with user and session context, use route-aware tracing, and prevent source maps from being served to clients.
+
+#### Scenario: Journal error includes user context
+- **WHEN** an authenticated Journal user triggers an error
+- **THEN** the Sentry event SHALL include the user's ID and username
+
+#### Scenario: Journal error without user context
+- **WHEN** an unauthenticated visitor triggers an error
+- **THEN** the Sentry event SHALL have no user context (Sentry.setUser(null))
+
+#### Scenario: Planner error includes session ID
+- **WHEN** an error occurs during a Planner session
+- **THEN** the Sentry event SHALL include a `session_id` tag with the active session ID
+
+#### Scenario: Route-level performance traces
+- **WHEN** a user navigates between routes in either app
+- **THEN** Sentry SHALL create a transaction span named after the route pattern (e.g., `/routes/:id`)
+
+#### Scenario: Source maps not served to clients
+- **WHEN** a client requests a `.map` file from the production server
+- **THEN** the server SHALL return 404 (source maps are uploaded to Sentry during build, not shipped in the bundle)