fix(webui): remediate PR #876 REQUEST_CHANGES for analytics (#651)

Address review blockers and medium/low findings:

- F1: HTML-escape all dynamic analytics fields (html.escape quote=True)
- F2: Gate POST /api/v1/analytics/usage through console_authz
  record_analytics_usage (fail closed for unauthenticated / Phase 1)
- F3: Enforce usage_events retention (max rows + max age)
- F4: Coerce None remote/org/repo to empty strings in load_analytics

Add tests for XSS escaping, unauthorized ingest deny, retention, and
None scope coercion. Document authz + retention in analytics guide.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

webui/analytics_loader.py

@@ -306,6 +306,11 @@ def load_analytics(
     model_filter = (model or "").strip() or None
     stage_filter = (stage or "").strip() or None
 
+    # F4: coerce optional scope filters to str so AnalyticsSnapshot never holds None.
+    scope_remote = (remote or "").strip()
+    scope_org = (org or "").strip()
+    scope_repo = (repo or "").strip()
+
     try:
         db = control_plane_db.ControlPlaneDB(db_path=db_path)
         rows = db.query_usage_events(
@@ -326,9 +331,9 @@ def load_analytics(
             ok=False,
             reason=f"control_plane_db_unavailable: {exc}",
             schema_version=ANALYTICS_SCHEMA_VERSION,
-            remote=remote,
-            org=org,
-            repo=repo,
+            remote=scope_remote,
+            org=scope_org,
+            repo=scope_repo,
             total_events=0,
             overall_summary=empty_summary,
             by_project={},
@@ -346,24 +351,24 @@ def load_analytics(
             UsageEvent(
                 usage_id=r["usage_id"],
                 session_id=r.get("session_id"),
-                remote=r.get("remote", remote),
-                org=r.get("org", org),
-                repo=r.get("repo", repo),
+                remote=r.get("remote") or scope_remote,
+                org=r.get("org") or scope_org,
+                repo=r.get("repo") or scope_repo,
                 project_id=r.get("project_id"),
-                role=r.get("role", "unknown"),
-                model=r.get("model", "unknown"),
+                role=r.get("role") or "unknown",
+                model=r.get("model") or "unknown",
                 issue_number=r.get("issue_number"),
                 pr_number=r.get("pr_number"),
-                stage=r.get("stage", "unknown"),
+                stage=r.get("stage") or "unknown",
                 input_tokens=r.get("input_tokens"),
                 output_tokens=r.get("output_tokens"),
                 total_tokens=r.get("total_tokens"),
                 estimated_cost_usd=r.get("estimated_cost_usd"),
                 latency_ms=r.get("latency_ms"),
                 duration_ms=r.get("duration_ms"),
-                status=r.get("status", "success"),
+                status=r.get("status") or "success",
                 metadata=meta,
-                created_at=r.get("created_at", ""),
+                created_at=r.get("created_at") or "",
             )
         )
 
@@ -410,9 +415,9 @@ def load_analytics(
         ok=True,
         reason="ok",
         schema_version=ANALYTICS_SCHEMA_VERSION,
-        remote=remote,
-        org=org,
-        repo=repo,
+        remote=scope_remote,
+        org=scope_org,
+        repo=scope_repo,
         total_events=len(parsed_events),
         overall_summary=overall_summary,
         by_project=by_project,