Make analytics endpoint dynamic: /t/{token} derived from APP_SECRET

The endpoint path is now /t/<8-char hash of APP_SECRET> instead of
static /t. Token is injected via data-e attribute on body, read by JS.
Server validates token on every hit, returns 404 if invalid.
Changes with each APP_SECRET = impossible to hardcode in a blocker.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

assets/modules/analytics.js

@@ -1,4 +1,4 @@
-const ENDPOINT = '/t'
+let ENDPOINT = '/t'
 const SK_UID = '_u'
 const SK_HASH = '_h'
 
@@ -86,7 +86,9 @@ async function trackPageView(visitor) {
 
 export async function initAnalytics() {
     const keyB64 = document.body.dataset.k
-    if (!keyB64) return
+    const ep = document.body.dataset.e
+    if (!keyB64 || !ep) return
+    ENDPOINT = ep
 
     try {
         encKey = await importKey(keyB64)