[BF-031] 隐私友好的 analytics taxonomy

[baixiangcpp]

Issue

Closes #56

Scope

• Establish a privacy-safe analytics event taxonomy and source guard.
• Replace free-form analytics calls with typed allowlisted wrappers.
• Document the taxonomy and sync Privacy Policy / Trust Center copy across all supported locales.
• Keep runtime analytics disabled by default and avoid any provider, cookie, user identifier, or external request.

Implementation

• Added src/core/analytics/taxonomy.json with allowlisted events, allowed params, forbidden params, and bucket names.
• Reworked src/core/analytics/analytics.ts into a typed no-op facade that only builds allowlisted payloads.
• Removed legacy free-form analytics APIs and the old Web Vitals analytics component.
• Updated search, related-tool, copy/download/tool action, and PWA install hooks to use safe wrappers only.
• Updated scripts/gates/check-analytics-taxonomy.js and added guard tests for allowed events, forbidden params, docs, and source usage.
• Added docs/privacy/analytics-taxonomy.md and localized Privacy / Trust Center analytics copy for en, zh-CN, zh-TW, ja, ko, de, and fr.

Acceptance Criteria

• 事件 taxonomy 有文档。
• analytics 事件不包含用户输入、输出、JWT、密钥、日志正文、文件内容、图片内容或完整 URL。
• 搜索事件不记录搜索文本，只记录查询长度分桶和结果数量。
• 文件相关事件不记录文件名、文件内容或 hash。
• Privacy Policy 说明匿名、最小化统计。
• Trust Center 说明 analytics allowlist 和禁止字段。
• npm run check:analytics-taxonomy 通过。
• npm run validate 通过。
• npm run build 通过。

Validation

• npm run lint - PASS
• npm run test - PASS, 224 files / 1124 tests
• npm run validate - PASS, including check:analytics-taxonomy, check:i18n, check:i18n-qa, check:privacy-copy, security, SEO, OG, bundle, and type gates
• npm run build - PASS, generated 1401 static pages; canonical/hreflang, metadata localization, JSON-LD, rendered i18n copy, and localized content gates passed
• npm run test:e2e:smoke - PASS
• npm run test:e2e:pwa - PASS, including service worker, cache buckets, offline fallback, and manual cache clear
• npm run check:analytics-taxonomy - PASS

Manual Checks

• Confirmed issue [BF-031] 隐私友好的 analytics taxonomy #56 is open before starting this PR.
• Searched source for removed legacy analytics APIs: trackEvent, trackCTA, trackToolUsage, trackPageView, trackSeoLanding.
• Searched analytics surfaces for cookies, user IDs, session IDs, full URLs, filenames, file contents, search query text, token/JWT/secret fields, and remote send APIs.
• Reviewed localized Privacy / Trust Center analytics copy in all supported locales.

Privacy Check

• 不采集工具输入
• 不采集工具输出
• 不新增未披露的外部请求
• 不持久化敏感 payload
• No third-party script, analytics SDK, cookie, user-level identifier, fingerprinting, or provider configuration was added.
• Search query text, full URLs, file names, file contents, image contents, JWTs, secrets, logs, and hashes are forbidden by taxonomy and source gate.

Screenshots / Evidence

• Evidence is command output from the validation suite above; this PR has no visual UI layout change.

[cloudflare-workers-and-pages]

Deploying byteflow with    Cloudflare Pages

Latest commit:	605ac06
Status:	✅  Deploy successful!
Preview URL:	https://bce07d9d.byteflow-c58.pages.dev
Branch Preview URL:	https://feat-bf-031-privacy-preservi.byteflow-c58.pages.dev

View logs