Web: drop consent banner, PostHog runs unconditionally with the key

PostHog runs in anonymous mode (person_profiles: 'never', all inputs
masked), so no consent gate is needed. Banner is removed; analytics.ts
loads PostHog whenever PUBLIC_POSTHOG_KEY is set. Unset the key to
disable.

Author: teovl

web/ANALYTICS.md

@@ -133,37 +133,23 @@ The GA4 data lives in property `530680522`. For programmatic access (Looker
 Studio, scripts, CI), use the service-account key at
 `~/.config/gcp-keys/ga-reader-key.json`. Don't commit it.
 
-## Privacy & consent
+## Privacy
 
-Two layers ship today:
+Two layers ship today, both anonymous, both no-banner:
 
-1. **GA4** (loaded sitewide, no banner). IP anonymization on, no PII, no
-   cross-site identifiers. The custom events above carry only the params
-   the docs declare — no free-form text, no form contents, no path-with-PII.
-2. **PostHog** (opt-in, gated on the consent banner). Session recordings
-   and heatmaps. Only loads when the user clicked **Allow** on the banner
-   in `src/components/ConsentBanner.astro`. Loaded with
-   `person_profiles: 'never'` (anonymous mode), `maskAllInputs: true`, and
-   any element marked `[data-private]` is masked in recordings.
+1. **GA4** (loaded sitewide). IP anonymization on, no PII, no cross-site
+   identifiers. The custom events above carry only the params the docs
+   declare — no free-form text, no form contents, no path-with-PII.
+2. **PostHog** (loaded sitewide when `PUBLIC_POSTHOG_KEY` is set). Session
+   recordings and heatmaps in `person_profiles: 'never'` (anonymous mode),
+   `maskAllInputs: true`. Anything marked `[data-private]` is masked in
+   recordings.
 
-The banner shows once per device (persisted in `localStorage` as
-`pilot-analytics-consent` ∈ `accepted | declined`). Cleared the
-choice? The banner reappears on next visit.
-
-PostHog only initialises when **both** conditions hold:
-- `localStorage['pilot-analytics-consent'] === 'accepted'`, AND
-- `PUBLIC_POSTHOG_KEY` is defined (set in your `.env` or Cloudflare Pages
-  environment vars).
-
-If the key is unset, the consent banner is decorative — clicking Allow does
-nothing harmful, just no recordings happen. To turn PostHog on for real:
+PostHog is the kill switch — unset `PUBLIC_POSTHOG_KEY` and nothing loads.
 
 ```bash
 # Sign up at https://posthog.com/, create a project, copy the API key.
-# Then in the Cloudflare Pages project settings:
+# In the Cloudflare Pages project settings:
 PUBLIC_POSTHOG_KEY=phc_xxxxxxxxxxxxxxxxxxxxxx
 PUBLIC_POSTHOG_HOST=https://us.i.posthog.com   # or eu.i.posthog.com
 ```
-
-To turn it off: unset the env var. The banner can stay; without a key,
-nothing loads.

web/src/components/ConsentBanner.astro

@@ -1,8 +1,6 @@
 ---
 // Full site footer - large display text + 4-column nav + fine print
-import ConsentBanner from './ConsentBanner.astro';
 ---
-<ConsentBanner />
 <footer class="site-footer">
   <div class="wrap">
     <div class="foot-big">

web/src/components/Footer.astro

@@ -22,7 +22,6 @@ declare global {
     dataLayer?: unknown[];
     gtag?: (...args: unknown[]) => void;
     pilotTrack?: (event: string, params?: Record<string, string | number | undefined>) => void;
-    pilotInitPostHog?: () => void;
   }
 }
 
@@ -46,52 +45,36 @@ function track(event: string, params: GtagParams = {}): void {
 
 window.pilotTrack = track;
 
-// --- PostHog (heatmaps + session recordings, gated on consent + key) ----
+// --- PostHog (heatmaps + session recordings, gated on key only) --------
 const POSTHOG_KEY = (import.meta as { env?: Record<string, string | undefined> }).env
   ?.PUBLIC_POSTHOG_KEY;
 const POSTHOG_HOST =
   (import.meta as { env?: Record<string, string | undefined> }).env?.PUBLIC_POSTHOG_HOST ||
   'https://us.i.posthog.com';
 
-let posthogStarted = false;
-
-async function initPostHog(): Promise<void> {
-  if (posthogStarted || !POSTHOG_KEY) return;
-  posthogStarted = true;
-  try {
-    const mod = await import('posthog-js');
-    const ph = (mod as { default: typeof mod }).default || mod;
-    (ph as unknown as { init: (k: string, opts: Record<string, unknown>) => void }).init(
-      POSTHOG_KEY,
-      {
-        api_host: POSTHOG_HOST,
-        person_profiles: 'never',
-        capture_pageview: true,
-        autocapture: true,
-        persistence: 'localStorage',
-        session_recording: {
-          maskAllInputs: true,
-          maskTextSelector: '[data-private]',
+if (POSTHOG_KEY) {
+  import('posthog-js')
+    .then((mod) => {
+      const ph = (mod as { default: typeof mod }).default || mod;
+      (ph as unknown as { init: (k: string, opts: Record<string, unknown>) => void }).init(
+        POSTHOG_KEY,
+        {
+          api_host: POSTHOG_HOST,
+          person_profiles: 'never',
+          capture_pageview: true,
+          autocapture: true,
+          persistence: 'localStorage',
+          session_recording: {
+            maskAllInputs: true,
+            maskTextSelector: '[data-private]',
+          },
         },
-      },
-    );
-  } catch (err) {
-    posthogStarted = false;
-    // Silent - PostHog is opt-in additive signal; failure must not break GA4.
-    console.warn('[analytics] posthog init failed', err);
-  }
-}
-
-window.pilotInitPostHog = initPostHog;
-
-if (typeof localStorage !== 'undefined') {
-  try {
-    if (localStorage.getItem('pilot-analytics-consent') === 'accepted') {
-      initPostHog();
-    }
-  } catch {
-    // localStorage may throw in privacy mode - skip silently
-  }
+      );
+    })
+    .catch((err) => {
+      // PostHog is additive; failure must not break GA4.
+      console.warn('[analytics] posthog init failed', err);
+    });
 }
 
 // --- Click delegation (incl. outbound, blog→docs handoff, dead_click) ---