Analytics without surveillance consent gates and local boundaries

Pain Tracker keeps analytics behind an env flag + explicit consent, avoids sending health data, and prefers local-only tracking where possible. Here’s the concrete pattern, grounded in the repo."