feat(analytics): replace custom pipeline with Matomo

Removes the hand-rolled analytics endpoint and SQLite event table in favour
of Matomo — a self-hosted, full-featured analytics platform.

k8s:
- Deploy MariaDB 11 + Bitnami Matomo 5 in the solitaire namespace
- Route analytics.aleshym.co ingress to the Matomo service
- Remove Datasette sidecar and its BasicAuth middleware/secret
- Remove the analytics port from the solitaire-server Service

Rust:
- Replace AnalyticsClient (custom HTTP endpoint) with MatomoClient (Matomo
  HTTP Tracking API bulk endpoint); maps game events to Matomo categories
- Add matomo_url + matomo_site_id fields to Settings (serde default → None/1)
- Privacy toggle in Settings now activates when matomo_url is set (not tied
  to SyncBackend::SolitaireServer)
- Remove POST /api/analytics route from solitaire_server

Web:
- Add Matomo JS tracking snippet to game.html (/play page)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

solitaire_data/src/settings.rs

@@ -244,12 +244,20 @@ pub struct Settings {
     #[serde(default)]
     pub take_from_foundation: bool,
     /// When `true`, anonymous game-play events (game start, game won, etc.)
-    /// are sent to the configured sync server for aggregate analytics. Opt-in;
-    /// defaults to `false`. Only active when `sync_backend` is
-    /// `SolitaireServer`. Older `settings.json` files deserialize cleanly to
-    /// `false` via `#[serde(default)]`.
+    /// are sent to the configured Matomo instance. Opt-in; defaults to `false`.
+    /// Requires `matomo_url` to be set. Older `settings.json` files deserialize
+    /// cleanly to `false` via `#[serde(default)]`.
     #[serde(default)]
     pub analytics_enabled: bool,
+    /// Base URL of the Matomo instance to send events to, e.g.
+    /// `"https://analytics.example.com"`. When `None` the analytics toggle has
+    /// no effect. Older `settings.json` files deserialize cleanly to `None`.
+    #[serde(default)]
+    pub matomo_url: Option<String>,
+    /// Matomo site ID assigned when the tracked site was created in Matomo.
+    /// Defaults to `1` (the first site created in a fresh Matomo install).
+    #[serde(default = "default_matomo_site_id")]
+    pub matomo_site_id: u32,
 }
 
 fn default_draw_mode() -> DrawMode {
@@ -318,6 +326,10 @@ fn default_replay_move_interval_secs() -> f32 {
     0.45
 }
 
+fn default_matomo_site_id() -> u32 {
+    1
+}
+
 /// Lower bound of the player-tunable replay-playback per-move interval,
 /// in seconds. Below this the cards barely register visually before
 /// the next move fires; the cap keeps the playback legible.
@@ -372,6 +384,8 @@ impl Default for Settings {
             leaderboard_display_name: None,
             take_from_foundation: false,
             analytics_enabled: false,
+            matomo_url: None,
+            matomo_site_id: default_matomo_site_id(),
         }
     }
 }