feat(mcp): add a typed PostHog wrapper module for src/mcp/server.ts (remote)

[JSONbored]

Context

Part of #6228 (telemetry spec — the tracked-field allowlist and vendor choice are already decided there: PostHog, tool name + caller type + success/failure + coarse latency only, no arguments/source/wallet/hotkey/trust-score data). This issue is the first concrete step: a thin, typed wrapper module around the PostHog Node SDK that the rest of this MCP-telemetry work builds on.

Requirements

• Add the PostHog Node SDK as a dependency of the root package (where src/mcp/server.ts lives).
• Create a small wrapper module (e.g. src/mcp/telemetry.ts) exposing a single typed function like recordMcpToolCall({ tool, callerType: "remote", ok, durationMs }) — no caller outside this module should construct a raw PostHog event.
• The wrapper must be a safe no-op (never throw) if the PostHog API key isn't configured for a given deployment — self-hosters who don't opt in to telemetry must see zero behavior change.
• Do not wire this into the actual tool-dispatch path yet — that's a separate issue (see Links).

Test Coverage Requirements

99%+ Codecov patch coverage; test both the "configured" and "not configured" (safe no-op) paths.

Deliverables

• src/mcp/telemetry.ts (or equivalent) with a typed recordMcpToolCall-style function.
• Safe no-op behavior when unconfigured, tested.

Expected Outcome

A ready-to-use, typed telemetry function the tool-dispatch instrumentation issue can call, with the field allowlist already enforced at the type level.

Links & Resources

• Spec: usage-telemetry instrumentation strategy for MCP (PostHog) #6228 (parent spec — tracked-field allowlist and vendor decision)
• The tool-dispatch instrumentation issue (filed alongside this one) will be the actual caller.

[linear-code]

JSO-4323