Telemetry Tracker v1.21.0

Added

• Privacy-conscious signup funnel measurement: consent-gated first-touch attribution now also stores a coarse acquisition channel and a sanitized first landing path (pathname + utm_source/medium/campaign only); registrations without forwarded attribution store only a no_consent marker. Projects record a set-once first_event_at on first accepted telemetry (kept through raw retention). GA4 sign_up fires after successful registration only under accepted consent. No IP, user agent, full referrer or fingerprint is stored (#791).

Upgrade notes

• Migration 20261012120000_signup_funnel (additive, nullable columns + backfill of Project.first_event_at; grants analytics_ro SELECT on the new columns if that role exists). Run prisma migrate deploy before deploying the API. No new env vars.