fix: address PR review comments - enduser.id timing, window global, consent double-dispatch

- Switch EnrichWithHttpRequest -> EnrichWithHttpResponse so enduser.id is set after
  authentication middleware has run and HttpContext.User is populated
- Remove window.ecsAppInsights assignment; window.ecsGetAppInsights() already
  provides controlled first-party access without exposing authenticatedId to
  third-party scripts via window enumeration
- Fix double ecs:consent-changed dispatch on returning-visitor page load: pass
  skipNotify:true when updateConsentMode() is called from loadConsentPreferences()
  so init()'s notifyConsentChanged() fires exactly once regardless

Author: BenjaminMichaelis

EssentialCSharp.Web/Program.cs

@@ -68,9 +68,11 @@ private static void Main(string[] args)
             options.Filter = ctx =>
                 !ctx.Request.Path.StartsWithSegments("/health")
                 && !ctx.Request.Path.StartsWithSegments("/alive");
-            options.EnrichWithHttpRequest = (activity, request) =>
+            // EnrichWithHttpResponse fires after the authentication middleware has run,
+            // so HttpContext.User is populated and IsAuthenticated is reliable.
+            options.EnrichWithHttpResponse = (activity, response) =>
             {
-                var user = request.HttpContext.User;
+                var user = response.HttpContext.User;
                 if (user?.Identity?.IsAuthenticated != true)
                 {
                     return;

EssentialCSharp.Web/wwwroot/js/appinsights-manager.js

@@ -149,7 +149,6 @@
                 }
                 if (!appInsights) {
                     appInsights = createAppInsights();
-                    window.ecsAppInsights = appInsights;
                 } else {
                     appInsights.config.disableTelemetry = false;
                     setAuthenticatedContext();

EssentialCSharp.Web/wwwroot/js/consent-manager.js

@@ -75,7 +75,7 @@ class ConsentManager {
                 });
 
                 this.consentState = { ...this.consentState, ...validatedPreferences };
-                this.updateConsentMode();
+                this.updateConsentMode({ skipNotify: true });
             } catch (e) {
                 // Malformed cookie — delete it so the banner is shown again
                 console.warn('Failed to parse consent preferences', e);
@@ -253,15 +253,17 @@ class ConsentManager {
         this.removeConsentBanner();
     }
 
-    updateConsentMode() {
+    updateConsentMode({ skipNotify = false } = {}) {
         if (window.gtag) {
             try {
                 window.gtag('consent', 'update', this.consentState);
             } catch (error) {
                 console.warn('Failed to update Google Consent Mode:', error);
             }
         }
-        this.notifyConsentChanged();
+        if (!skipNotify) {
+            this.notifyConsentChanged();
+        }
     }
 
     updateClarityConsent() {