fix(webui): remediate PR #876 REQUEST_CHANGES for analytics (#651)

Address review blockers and medium/low findings:

- F1: HTML-escape all dynamic analytics fields (html.escape quote=True)
- F2: Gate POST /api/v1/analytics/usage through console_authz
  record_analytics_usage (fail closed for unauthenticated / Phase 1)
- F3: Enforce usage_events retention (max rows + max age)
- F4: Coerce None remote/org/repo to empty strings in load_analytics

Add tests for XSS escaping, unauthorized ingest deny, retention, and
None scope coercion. Document authz + retention in analytics guide.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

webui/app.py

@@ -607,14 +607,53 @@ async def api_v1_analytics(request: Request) -> JSONResponse:
 
 
 async def api_v1_analytics_ingest(request: Request) -> JSONResponse:
-    """Optional session instrumentation ingestion endpoint (#651)."""
+    """Optional session instrumentation ingestion endpoint (#651).
+
+    Fail-closed write: every request is authorized through console_authz
+    (``record_analytics_usage``) before any control-plane DB mutation. Phase 1
+    keeps ``execution_enabled=False`` and denies unauthenticated callers, so
+    this route cannot be used as an unauthenticated write or XSS injection
+    vector (PR #876 F2).
+    """
     try:
         body = await request.json()
     except Exception:
-        return JSONResponse({"error": "invalid_json", "detail": "body must be valid JSON"}, status_code=400)
-
+        body = {}
     if not isinstance(body, dict):
-        return JSONResponse({"error": "invalid_payload", "detail": "payload must be a JSON object"}, status_code=400)
+        body = {}
+
+    principal = resolve_principal(headers=dict(request.headers))
+    decision = authorize(
+        "record_analytics_usage", principal, for_execution=True
+    )
+    allowed = bool(decision.allowed and decision.execution_enabled)
+    console_audit.record_event(
+        action_id="record_analytics_usage",
+        result=(
+            console_audit.RESULT_ALLOWED
+            if allowed
+            else console_audit.RESULT_DENIED
+        ),
+        decision=decision,
+        principal=principal,
+        target=_audit_target("record_analytics_usage", body),
+        request_id=_request_id(),
+        detail=decision.detail,
+    )
+    authorization = decision.to_dict()
+    if not allowed:
+        return JSONResponse(
+            {
+                "ok": False,
+                "error": "unauthorized",
+                "detail": (
+                    "POST /api/v1/analytics/usage requires an authenticated "
+                    "principal with record_analytics_usage execution enabled"
+                ),
+                "authorization": authorization,
+            },
+            status_code=403,
+        )
 
     usage_id = record_usage(
         session_id=body.get("session_id"),
@@ -636,7 +675,10 @@ async def api_v1_analytics_ingest(request: Request) -> JSONResponse:
         status=body.get("status", "success"),
         metadata=body.get("metadata"),
     )
-    return JSONResponse({"ok": True, "usage_id": usage_id}, status_code=201)
+    return JSONResponse(
+        {"ok": True, "usage_id": usage_id, "authorization": authorization},
+        status_code=201,
+    )
 
 
 async def method_not_allowed(request: Request, _exc: Exception) -> Response: