fix: filter +autoz QA telemetry

[steve8708]

Summary

• suppress +autoz QA identities at the shared server/browser tracking boundaries, including direct PostHog feedback events
• require +autoz in automated signup, beta, trusted-acceptance, and template QA identities
• preserve legacy synthetic +qa compatibility for existing fixtures and recipient suppression, and update authentication guidance/locales

Validation

• 71/71 repository guards
• 120 core tests, 50 plan tests, 30 clips tests, 21 QA/trusted-acceptance tests
• beta and signup TypeScript checks
• oxfmt check and git diff check

[github-actions]

Visual recap — generation failed

The visual recap could not be generated for this pull request. This is informational only and does not block the PR.

Diagnostic:

No plan URL: create-visual-recap failed 403 Forbidden: {"error":"Creating an org-visible visual recap requires an active organization. Connect Plan from an organization or publish with private visibility."}

Agent output: Wrote recap-source.json for CI’s deterministic publisher. It covers all 53 changed files and includes six annotated key-change tabs. --- ⠀ 🟢 Visual recap source is ready for CI publication. stderr: Reading additional input from stdin...

[builder-io-integration]

Builder reviewed your changes — looks good ✅

Review Details

Code Review Summary

This incremental review covers the latest PR head after fixes to AuthPage signup-view timing, AuthPage Google click timing, Clips public-share Google timing, and direct PostHog synthetic-traffic suppression. Direct inspection confirms those previously reported issues are fixed: signup-view tracking now requires a valid normalized email and only tracks once while on the signup view; AuthPage Google tracking occurs after the OAuth exchange supplies an email; the public-share Google path gates both events on the authenticated email; and sendPostHogEvent() checks the request synthetic-traffic flag.

The shared +autoz matcher remains narrowly scoped, the existing synthetic patterns remain intact, and the updated QA fixtures consistently use the new marker. No additional confirmed issues were identified in this incremental pass. The parallel worker calls were interrupted before returning findings, so this review records the verified latest-head inspection without inventing unconfirmed comments. Risk level: Standard.

🧪 Browser testing: Will run after this review (PR touches UI code).