fix(sentry): remove hardcoded DSN fallbacks; supply via env in CI

Self-hosted instances no longer inherit the trails.cool flagship Sentry
DSNs. Code paths now read DSN strictly from env — unset = no Sentry
init, no events sent.

Flagship continues to report unchanged: cd-apps.yml and cd-staging.yml
inject the public DSNs as workflow env vars, which feed into:
- runtime via \`infrastructure/app.env\` / \`staging.env\`
  (\`SENTRY_DSN_JOURNAL\` / \`SENTRY_DSN_PLANNER\` → compose env per service)
- build time via docker build-arg \`VITE_SENTRY_DSN\` (journal only;
  planner has no client Sentry init).

Sentry DSNs are public-by-design (transmitted unencrypted from the
client JS bundle), so embedding them as plaintext workflow env vars
is no worse than the runtime exposure. Forks should replace these with
their own DSNs or remove the workflow env lines to ship Sentry-free.

Files changed:
- apps/journal/server.ts: \`process.env.SENTRY_DSN\` only, no fallback
- apps/planner/server.ts: same
- apps/journal/app/lib/sentry.client.ts: \`import.meta.env.VITE_SENTRY_DSN\`
  only; falsy = skip init
- apps/journal/Dockerfile: new \`ARG VITE_SENTRY_DSN\` baked into build
- infrastructure/docker-compose.yml: pass \`SENTRY_DSN\` per service
- infrastructure/docker-compose.staging.yml: same
- .github/workflows/cd-apps.yml: workflow env + build-arg + app.env echo
- .github/workflows/cd-staging.yml: same

Full repo: pnpm typecheck, pnpm lint, pnpm test, journal build all green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/cd-apps.yml

@@ -13,6 +13,15 @@ concurrency:
   group: deploy-apps
   cancel-in-progress: true
 
+# Public Sentry DSNs for the trails.cool flagship instance. Public by
+# design — Sentry DSNs are transmitted unencrypted from the client JS
+# bundle, embedding them in this workflow is no worse than embedding
+# them in the runtime env. Self-hosted forks should either replace
+# these with their own DSNs or remove the lines to ship without Sentry.
+env:
+  SENTRY_DSN_JOURNAL: "https://a32ffcc575d34be072e91b20f247eeee@o4509530546634752.ingest.de.sentry.io/4509530555547728"
+  SENTRY_DSN_PLANNER: "https://5215134cd78d5e6c199e29300b8425af@o4509530546634752.ingest.de.sentry.io/4511102546608208"
+
 jobs:
   build-images:
     name: Build & Push Docker Images
@@ -48,8 +57,12 @@ jobs:
           tags: |
             ghcr.io/trails-cool/${{ matrix.app }}:latest
             ghcr.io/trails-cool/${{ matrix.app }}:${{ github.sha }}
+          # VITE_SENTRY_DSN bakes the client-side DSN into the journal's
+          # built bundle. Only journal has a client Sentry init; planner
+          # ignores the build-arg if present.
           build-args: |
             SENTRY_RELEASE=${{ github.sha }}
+            VITE_SENTRY_DSN=${{ matrix.app == 'journal' && env.SENTRY_DSN_JOURNAL || '' }}
           secrets: |
             SENTRY_AUTH_TOKEN=/tmp/sentry_token
 
@@ -70,6 +83,9 @@ jobs:
           echo "DOMAIN=trails.cool" >> infrastructure/app.env
           # Flagship marker — see cd-infra.yml for what this gates.
           echo "IS_FLAGSHIP=true" >> infrastructure/app.env
+          # Sentry DSNs (public — see workflow top-level env for context).
+          echo "SENTRY_DSN_JOURNAL=$SENTRY_DSN_JOURNAL" >> infrastructure/app.env
+          echo "SENTRY_DSN_PLANNER=$SENTRY_DSN_PLANNER" >> infrastructure/app.env
 
       - name: Copy files to server
         uses: appleboy/scp-action@v1

.github/workflows/cd-staging.yml

@@ -30,6 +30,12 @@ concurrency:
   group: staging-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || 'main' }}
   cancel-in-progress: true
 
+# Public Sentry DSNs (same as cd-apps.yml). See that workflow for the
+# "public by design" rationale.
+env:
+  SENTRY_DSN_JOURNAL: "https://a32ffcc575d34be072e91b20f247eeee@o4509530546634752.ingest.de.sentry.io/4509530555547728"
+  SENTRY_DSN_PLANNER: "https://5215134cd78d5e6c199e29300b8425af@o4509530546634752.ingest.de.sentry.io/4511102546608208"
+
 jobs:
   # ── Build ─────────────────────────────────────────────────────────────
   # Tags:
@@ -89,6 +95,7 @@ jobs:
             ghcr.io/trails-cool/${{ matrix.app }}:${{ steps.tags.outputs.sha }}
           build-args: |
             SENTRY_RELEASE=${{ steps.tags.outputs.sha }}
+            VITE_SENTRY_DSN=${{ matrix.app == 'journal' && env.SENTRY_DSN_JOURNAL || '' }}
           secrets: |
             SENTRY_AUTH_TOKEN=/tmp/sentry_token
 
@@ -118,6 +125,8 @@ jobs:
             echo "JOURNAL_IMAGE_TAG=staging"
             echo "PLANNER_IMAGE_TAG=staging"
             echo "SENTRY_RELEASE=${{ github.sha }}"
+            echo "SENTRY_DSN_JOURNAL=$SENTRY_DSN_JOURNAL"
+            echo "SENTRY_DSN_PLANNER=$SENTRY_DSN_PLANNER"
           } >> infrastructure/staging.env
 
       - name: Copy compose file + env to server
@@ -220,6 +229,8 @@ jobs:
             # PR-preview journals all share the persistent staging planner.
             echo "PLANNER_URL=https://planner.staging.trails.cool"
             echo "SENTRY_RELEASE=${{ github.event.pull_request.head.sha }}"
+            echo "SENTRY_DSN_JOURNAL=$SENTRY_DSN_JOURNAL"
+            echo "SENTRY_DSN_PLANNER=$SENTRY_DSN_PLANNER"
           } >> infrastructure/staging-pr-${{ steps.ports.outputs.pr }}.env
 
       - name: Generate per-PR Caddyfile snippet