fix(webui): remediate PR #876 REQUEST_CHANGES for analytics (#651)

Address review blockers and medium/low findings:

- F1: HTML-escape all dynamic analytics fields (html.escape quote=True)
- F2: Gate POST /api/v1/analytics/usage through console_authz
  record_analytics_usage (fail closed for unauthenticated / Phase 1)
- F3: Enforce usage_events retention (max rows + max age)
- F4: Coerce None remote/org/repo to empty strings in load_analytics

Add tests for XSS escaping, unauthorized ingest deny, retention, and
None scope coercion. Document authz + retention in analytics guide.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/observability/analytics-instrumentation.md

@@ -89,11 +89,17 @@ record_usage(
 )
 ```
 
-### HTTP Ingestion API
+### HTTP Ingestion API (authorized write)
+
+`POST /api/v1/analytics/usage` is a **gated write**. It runs through
+`console_authz` action `record_analytics_usage` (operator+, Phase 2 execution).
+Unauthenticated or phase-inactive requests receive **403** and do not write.
+Prefer in-process `record_usage` for MCP / session instrumentation.
 
 ```http
 POST /api/v1/analytics/usage HTTP/1.1
 Content-Type: application/json
+# Requires authenticated principal with record_analytics_usage execution enabled
 
 {
   "remote": "dadeschools",
@@ -114,6 +120,18 @@ Content-Type: application/json
 }
 ```
 
+### Retention
+
+`usage_events` is retained with hard caps applied on every write:
+
+| Limit | Default |
+|---|---|
+| Max rows | 10,000 (`ControlPlaneDB.USAGE_EVENTS_MAX_ROWS`) |
+| Max age | 90 days (`ControlPlaneDB.USAGE_EVENTS_RETENTION_DAYS`) |
+
+Older rows (by `created_at`) and excess oldest rows (by `usage_id`) are deleted
+after each insert so unbounded growth / DoS-by-volume cannot fill the DB.
+
 ---
 
 ## 6. Querying Analytics API

docs/webui-authz-audit.md

@@ -91,6 +91,7 @@ already define, and a regression test asserts each mapping matches.
 | `close_pr` | controller | privileged | `gitea.pr.close` | Yes | No | No | 3 |
 | `merge_pr` | controller | privileged | `gitea.pr.merge` | Yes | **Yes** | **Yes** | 3 |
 | `delete_branch` | admin | destructive | `gitea.branch.delete` | Yes | **Yes** | **Yes** | 3 |
+| `record_analytics_usage` | operator | gated_write | `runtime.record_analytics_usage` | Yes | No | No | 2 |
 
 **Dual control** means the acting principal may not be the sole authority: a
 second distinct principal must confirm. **Break-glass** means the action is