fix: address PR review comments on App Insights telemetry

- appinsights-manager.js: ecsGetCorrelationContext() now returns a full
  W3C traceparent (00-{traceId}-{spanId}-01) instead of a bare 32-hex
  traceId, removing ambiguity for callers
- appinsights-manager.js: script.remove() on onerror and on 15s timeout
  so the dead element is cleaned up and a subsequent retry appends a
  fresh <script> element rather than waiting another 15s
- _Layout.cshtml: replace window.AUTHENTICATED_USER_ID global with a
  <meta name='ecs-auth-user-id'> tag, scoped to avoid exposing the
  stable user GUID to third-party scripts that enumerate window globals
- appinsights-manager.js: getAuthenticatedUserId() reads from meta tag
- Program.cs: validate ingestionUri.Scheme == https before emitting
  into CSP header to guard against malformed connection strings
- Program.cs: remove legacy dc.services.visualstudio.com from
  connect-src (modern resources use *.in.applicationinsights.azure.com)

Author: BenjaminMichaelis

EssentialCSharp.Web/Program.cs

@@ -512,7 +512,7 @@ await McpJsonRpcResponseWriter.WriteErrorAsync(
                 $"style-src 'self' 'unsafe-inline' cdnjs.cloudflare.com fonts.googleapis.com https://hcaptcha.com https://*.hcaptcha.com",
                 $"font-src 'self' fonts.gstatic.com cdnjs.cloudflare.com",
                 $"img-src 'self' data: https:",
-                $"connect-src 'self' https://hcaptcha.com https://*.hcaptcha.com https://api.pwnedpasswords.com https://*.algolia.net https://*.algolianet.com https://*.google-analytics.com https://*.clarity.ms https://dc.services.visualstudio.com https://*.in.applicationinsights.azure.com{GetApplicationInsightsCspSources(app.Configuration["APPLICATIONINSIGHTS_CONNECTION_STRING"])}{tryDotNetSources}",
+                $"connect-src 'self' https://hcaptcha.com https://*.hcaptcha.com https://api.pwnedpasswords.com https://*.algolia.net https://*.algolianet.com https://*.google-analytics.com https://*.clarity.ms https://*.in.applicationinsights.azure.com{GetApplicationInsightsCspSources(app.Configuration["APPLICATIONINSIGHTS_CONNECTION_STRING"])}{tryDotNetSources}",
                 $"frame-src https://hcaptcha.com https://*.hcaptcha.com https://newassets.hcaptcha.com{tryDotNetSources}",
                 $"worker-src blob:",
                 $"frame-ancestors 'none'",
@@ -678,7 +678,9 @@ private static string GetApplicationInsightsCspSources(string? connectionString)
         }
 
         string? ingestionEndpoint = GetConnectionStringValue(connectionString, "IngestionEndpoint");
-        if (string.IsNullOrWhiteSpace(ingestionEndpoint) || !Uri.TryCreate(ingestionEndpoint, UriKind.Absolute, out Uri? ingestionUri))
+        if (string.IsNullOrWhiteSpace(ingestionEndpoint)
+            || !Uri.TryCreate(ingestionEndpoint, UriKind.Absolute, out Uri? ingestionUri)
+            || ingestionUri.Scheme != Uri.UriSchemeHttps)
         {
             return string.Empty;
         }

EssentialCSharp.Web/Views/Shared/_Layout.cshtml

@@ -55,6 +55,15 @@
     <!-- Cookie Consent Manager - Load before analytics -->
     <script src="~/js/consent-manager.js" asp-append-version="true"></script>
     <script src="~/js/appinsights-manager.js" asp-append-version="true"></script>
+    @{
+        string? authUserId = User.FindFirstValue(ClaimTypes.NameIdentifier);
+    }
+    @if (!string.IsNullOrEmpty(authUserId))
+    {
+        // Scoped to a <meta> tag rather than a window global to avoid exposing the stable
+        // user GUID to third-party scripts that enumerate window properties.
+        <meta name="ecs-auth-user-id" content="@authUserId" />
+    }
 
     <!-- Microsoft Clarity - Will be activated based on consent -->
     <script type="text/javascript">
@@ -193,7 +202,6 @@
         window.IS_AUTHENTICATED = @Json.Serialize(SignInManager.IsSignedIn(User));
         window.TRYDOTNET_ORIGIN = @Json.Serialize(Configuration["TryDotNet:Origin"]);
         window.APPLICATIONINSIGHTS_CONNECTION_STRING = @Json.Serialize(Configuration["APPLICATIONINSIGHTS_CONNECTION_STRING"]);
-        window.AUTHENTICATED_USER_ID = @Json.Serialize(User.FindFirstValue(ClaimTypes.NameIdentifier));
         window.BUILD_LABEL = @Json.Serialize(buildLabel);
         window.ENABLE_CHAT_WIDGET = @Json.Serialize(!Context.Request.Path.StartsWithSegments("/Identity"));
     </script>

EssentialCSharp.Web/wwwroot/js/appinsights-manager.js

@@ -25,8 +25,12 @@
     }
 
     function getAuthenticatedUserId() {
-        const userId = window.AUTHENTICATED_USER_ID;
-        return typeof userId === "string" && userId.trim().length > 0 ? userId.trim() : null;
+        // Read from a <meta> tag rather than a window global to avoid exposing the stable
+        // user GUID to third-party scripts that enumerate window properties.
+        const meta = document.querySelector('meta[name="ecs-auth-user-id"]');
+        if (!meta) { return null; }
+        const value = meta.getAttribute("content") || "";
+        return value.trim().length > 0 ? value.trim() : null;
     }
 
     function setAuthenticatedContext() {
@@ -64,13 +68,20 @@
                     resolve();
                     return;
                 }
-                // Guard: script may have already errored — add timeout so promise doesn't hang forever
+                // Guard: script may have already errored — add timeout so promise doesn't hang forever.
+                // On timeout, remove the dead element so the next retry can append a fresh one.
                 const timeoutId = setTimeout(() => {
                     sdkLoadPromise = null;
+                    existing.remove();
                     reject(new Error("App Insights SDK load timed out."));
                 }, 15000);
                 existing.addEventListener("load", () => { clearTimeout(timeoutId); resolve(); }, { once: true });
-                existing.addEventListener("error", () => { clearTimeout(timeoutId); sdkLoadPromise = null; reject(new Error("Failed to load App Insights SDK.")); }, { once: true });
+                existing.addEventListener("error", () => {
+                    clearTimeout(timeoutId);
+                    sdkLoadPromise = null;
+                    existing.remove(); // remove so the next retry appends a fresh element
+                    reject(new Error("Failed to load App Insights SDK."));
+                }, { once: true });
                 return;
             }
 
@@ -81,6 +92,7 @@
             script.onload = () => resolve();
             script.onerror = () => {
                 sdkLoadPromise = null; // allow retry on transient failure
+                script.remove(); // remove dead element so the next retry appends a fresh one
                 reject(new Error("Failed to load App Insights SDK."));
             };
             document.head.appendChild(script);
@@ -173,10 +185,17 @@
         }
     }
 
-    function getCurrentTraceId() {
+    function generateSpanId() {
+        const arr = new Uint8Array(8);
+        crypto.getRandomValues(arr);
+        return Array.from(arr, function (b) { return b.toString(16).padStart(2, "0"); }).join("");
+    }
+
+    function getCurrentTraceparent() {
         const traceId = appInsights?.context?.telemetryTrace?.traceID;
         if (typeof traceId === "string" && /^[a-f0-9]{32}$/i.test(traceId)) {
-            return traceId.toLowerCase();
+            // Return a full W3C traceparent so callers don't need to synthesise span IDs.
+            return `00-${traceId.toLowerCase()}-${generateSpanId()}-01`;
         }
         return null;
     }
@@ -185,8 +204,10 @@
         return appInsights;
     };
 
+    // Returns a W3C traceparent string (00-{traceId}-{spanId}-01) suitable for passing
+    // as configuration.correlationContext to the TryDotNet SDK.
     window.ecsGetCorrelationContext = function () {
-        return getCurrentTraceId();
+        return getCurrentTraceparent();
     };
 
     function init() {