feat(settings): add anonymous analytics opt-out

[wukko]

Problem

Anonymous analytics could only be disabled through an environment variable. Users should also be able to opt out from desktop, web, and mobile settings without restarting the server.

Change

Adds an Anonymous analytics toggle under Privacy in desktop/web General settings and mobile Maintenance settings.

The setting persists per environment and disables both server analytics and client usage events sent through the server. Buffered events and retries are discarded while disabled. Re-enabling resumes collection without replaying discarded events.

T3CODE_TELEMETRY_ENABLED=false still takes precedence. When it forces analytics off, the toggle is disabled and shows a notice. Selecting environments with different override states shows a disabled mixed control.

Analytics remain enabled by default.

Scope and approval

This configures the existing analytics capability, which already supports an environment-variable opt-out. The setting controls that same collection and delivery behavior without adding new collection, changing which events are collected, or changing the default.

Closes #4123.

Follow-up to the analytics disclosure fixes in #16563, #16564, and #16565.

Verification

176 tests passed, covering persistence, settings sharing, opt-out, discarded queues and retries, and re-enabling. Server, web, and mobile typechecks passed. Formatting and targeted lint passed with existing lint warnings.

Tested the toggle in the web client and iOS simulator. Mobile changes persisted on the server and appeared immediately in the web client. Checked enabled, disabled, mixed, and overridden states, including the disabled controls and override notices.

Desktop and native iOS builds passed, along with iOS/Android JavaScript exports. Android was not built natively or tested on a device.

Screenshots

Desktop

Before

Enabled

Overridden by an environment variable

Mixed override across environments

Mobile

Before

Enabled

Overridden by an environment variable

Mixed override across environments

Model and harness

Implemented with GPT-6 Astra and GPT-6.1-Sol. Both used the Codex harness.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a cross-platform anonymous-analytics opt-out that changes persisted settings, environment synchronization, and server telemetry buffering and delivery behavior. An unresolved Medium-severity finding also indicates queued events may survive an opt-out and be sent after re-enabling telemetry.

Not approved because:

• 1 blocking correctness issue found at or above your repo's Minimum Blocking Severity

^{Adjust the Minimum Blocking Severity for this repo — including turning it Off — in Settings. You can add or adjust custom eligibility rules. Learn more.}