feat(analytics): load Umami first-party via /_a (ADR-0006 Phase 2c) (#43)

Switch the api.jellyrock.app footer tracker from cross-origin
analytics.jellyrock.app/script.js to the same-origin /_a proxy (live since
infra #27):

  <script defer src="/_a/script.js" data-website-id="…"
          data-host-url="https://api.jellyrock.app/_a"></script>

Events POST to /_a/api/send → Caddy strips to umami's /api/send. Works under the
current CSP (/_a/script.js is 'self'); shared CSP tightens in the final infra
phase. analytics.jellyrock.app stays live as rollback (Bridge scope).

Verified: jsdoc.json is valid JSON; footer embeds /_a/script.js + data-host-url
with zero analytics.jellyrock.app references.

Author: cewert

jsdoc.json

@@ -49,7 +49,7 @@
           "id": "jellyfin-link"
         }
       ],
-      "footer": "<span class=\"jsdoc-message\">Automatically generated using <a href=\"https://github.com/jsdoc/jsdoc\" target=\"_blank\">JSDoc</a> and the <a href=\"https://github.com/ankitskvmdam/clean-jsdoc-theme\" target=\"_blank\">clean-jsdoc-theme</a>.</span><script defer src=\"https://analytics.jellyrock.app/script.js\" data-website-id=\"07139597-641c-42e6-8f5a-cbb0d9182a20\"></script>"
+      "footer": "<span class=\"jsdoc-message\">Automatically generated using <a href=\"https://github.com/jsdoc/jsdoc\" target=\"_blank\">JSDoc</a> and the <a href=\"https://github.com/ankitskvmdam/clean-jsdoc-theme\" target=\"_blank\">clean-jsdoc-theme</a>.</span><script defer src=\"/_a/script.js\" data-website-id=\"07139597-641c-42e6-8f5a-cbb0d9182a20\" data-host-url=\"https://api.jellyrock.app/_a\"></script>"
     }
   },
   "markdown": {