fix(webui): remediate PR #876 REQUEST_CHANGES for analytics (#651)

Address review blockers and medium/low findings:

- F1: HTML-escape all dynamic analytics fields (html.escape quote=True)
- F2: Gate POST /api/v1/analytics/usage through console_authz
  record_analytics_usage (fail closed for unauthenticated / Phase 1)
- F3: Enforce usage_events retention (max rows + max age)
- F4: Coerce None remote/org/repo to empty strings in load_analytics

Add tests for XSS escaping, unauthorized ingest deny, retention, and
None scope coercion. Document authz + retention in analytics guide.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

control_plane_db.py

@@ -577,6 +577,11 @@ class ControlPlaneDB:
         conn.execute("CREATE INDEX IF NOT EXISTS idx_usage_events_role_model ON usage_events(role, model);")
         conn.execute("CREATE INDEX IF NOT EXISTS idx_usage_events_stage ON usage_events(stage);")
 
+    # #651 retention: cap growth so unauthenticated or high-volume ingest
+    # cannot DoS the control-plane DB (PR #876 F3). Applied after every write.
+    USAGE_EVENTS_MAX_ROWS = 10_000
+    USAGE_EVENTS_RETENTION_DAYS = 90
+
     def record_usage_event(
         self,
         *,
@@ -649,7 +654,35 @@ class ControlPlaneDB:
                     ts,
                 ),
             )
-            return cursor.lastrowid
+            usage_id = cursor.lastrowid
+            self._enforce_usage_events_retention(conn)
+            return usage_id
+
+    def _enforce_usage_events_retention(self, conn: sqlite3.Connection) -> None:
+        """Drop aged and excess usage_events rows (PR #876 F3)."""
+        # Age-based: ISO-8601 UTC timestamps compare lexicographically.
+        cutoff = (
+            datetime.now(timezone.utc)
+            - timedelta(days=int(self.USAGE_EVENTS_RETENTION_DAYS))
+        ).strftime("%Y-%m-%dT%H:%M:%SZ")
+        conn.execute(
+            "DELETE FROM usage_events WHERE created_at < ?",
+            (cutoff,),
+        )
+        # Count-based: keep the newest USAGE_EVENTS_MAX_ROWS by usage_id.
+        max_rows = int(self.USAGE_EVENTS_MAX_ROWS)
+        if max_rows > 0:
+            conn.execute(
+                """
+                DELETE FROM usage_events
+                WHERE usage_id NOT IN (
+                    SELECT usage_id FROM usage_events
+                    ORDER BY usage_id DESC
+                    LIMIT ?
+                )
+                """,
+                (max_rows,),
+            )
 
     def query_usage_events(
         self,