Use SECRET_ANALYTICS env var, regenerated at each deployment

- New SECRET_ANALYTICS variable replaces kernel.secret for analytics
- Ansible generates a random 32-char secret at each deploy
- Endpoint token and encryption key change with every deployment
- Existing sessions will get new visitor_id after deploy (expected)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ansible/deploy.yml

@@ -21,6 +21,10 @@
       set_fact:
         docker_gid: "{{ docker_sock.stat.gid }}"
 
+    - name: Generate analytics secret
+      set_fact:
+        analytics_secret: "{{ lookup('password', '/dev/null chars=ascii_lowercase,digits length=32') }}"
+
   tasks:
     - name: Deploy .env.local
       template:

ansible/env.local.j2

@@ -24,3 +24,4 @@ OAUTH_KEYCLOAK_CLIENT_ID=e-ticket
 OAUTH_KEYCLOAK_CLIENT_SECRET=1oLwbhJDNVmGH8CES1OdQtzR7dECOlII
 OAUTH_KEYCLOAK_URL=https://auth.esy-web.dev
 OAUTH_KEYCLOAK_REALM=e-cosplay
+SECRET_ANALYTICS={{ analytics_secret }}