fix(analytics): declare the script build arg and send the Track API's real envelope

Two blockers found while wiring OpenPanel for real:

- frontend/Dockerfile declared ARG for VITE_OPENPANEL_URL/CLIENT_ID/SENTRY_DSN but not
  VITE_OPENPANEL_SCRIPT_URL, so passing it as a build arg was silently ignored and the
  loader compiled out (import.meta.env value undefined).
- backend/app/services/analytics.py posted a flat {type, event, properties} body; the
  Track API expects {type, payload:{event, properties, profileId}} (verified against the
  SDK source in packages/sdks/sdk). The API answered 400 and the module swallows every
  error by design, so all server-side events were being dropped without a trace.

Verified after deploy: the bundle carries the client id + op1.js URL + the queueing shim,
op1.js serves 200, and a track event posted with the real envelope lands in OpenPanel.

frontend/Dockerfile

@@ -23,9 +23,13 @@ ENV VITE_ENABLE_DEV_LOGIN=${DEV_LOGIN_ENABLED}
 # Empty values disable the feature (analytics.ts is a no-op then).
 ARG VITE_OPENPANEL_URL=""
 ARG VITE_OPENPANEL_CLIENT_ID=""
+# The browser script (op1.js) lives on the dashboard origin, not under the API path,
+# so it needs its own arg — defined here or the value never reaches the bundle.
+ARG VITE_OPENPANEL_SCRIPT_URL=""
 ARG VITE_SENTRY_DSN=""
 ENV VITE_OPENPANEL_URL=${VITE_OPENPANEL_URL} \
     VITE_OPENPANEL_CLIENT_ID=${VITE_OPENPANEL_CLIENT_ID} \
+    VITE_OPENPANEL_SCRIPT_URL=${VITE_OPENPANEL_SCRIPT_URL} \
     VITE_SENTRY_DSN=${VITE_SENTRY_DSN}
 
 # Source code + build