Core: add shared browser analytics for Next Generation Frontend Platform apps #73791

Background

Applications in frontend/ have no shared browser analytics integration. Legacy Studio pages report directly from the browser through apps/src/metrics/AnalyticsReporter and StatsigReporter, but Next Generation Frontend Platform applications cannot preserve those events without importing the legacy apps/ bundle.

This blocks analytics parity for:

• Account Settings (Accounts: analytics parity for account settings #73227)
• Certificates (PR feat(certificates): render certificates client-side #73693)

Do not add a Rails event-proxy endpoint. The browser should continue to report analytics directly to the configured provider.

Scope

Add a supported analytics integration for applications built on @code-dot-org/core.

Start with a core plugin, following the default rule in frontend/packages/core/README.md. Use a separate package only if the provider SDK weight or lifecycle requirements justify that boundary.

The integration must:

• expose a small, typed, provider-independent event API to frontend/ packages;
• initialize during initializeCore and be opt-in at each application entrypoint;
• configure Statsig for the Studio application;
• preserve the existing consent rules and stable-ID behavior;
• update analytics identity when authentication state changes;
• support environment-specific configuration and a no-op provider for tests or disabled environments;
• buffer or safely discard events emitted before asynchronous provider initialization completes;
• keep provider details out of feature packages;
• avoid sending user-specific fields unless the event contract explicitly permits them;
• document event naming, payload conventions, initialization, consent, identity, and test usage.

The initial consumers are Account Settings and Certificates. Migrating unrelated legacy analytics callers is out of scope.

Acceptance criteria

• A frontend/ feature package can log a typed event without importing from apps/ or calling Rails.
• Studio registers the analytics integration and can deliver a test event to Statsig in an enabled non-production environment.
• Initialization honors consent before setting persistent identifiers or sending events.
• Sign-in and sign-out update or clear provider identity without reloading the page.
• Disabled and test configurations use a deterministic no-op or injectable test adapter.
• Unit tests cover initialization, pre-initialization events, consent transitions, identity transitions, provider failure, and disabled configuration.
• Core documentation explains why this is a plugin or separate package and shows the public API.
• Follow-up issues Accounts: analytics parity for account settings #73227 and the certificate analytics-parity work can consume the API without backend changes.

References

• frontend/packages/core/README.md, especially “Plugin vs. new package”
• frontend/packages/core/src/plugins/observability/ for the existing adapter and lifecycle pattern
• apps/src/metrics/AnalyticsReporter.js
• apps/src/metrics/StatsigReporter.js