feat(analytics): replace custom pipeline with Matomo

Removes the hand-rolled analytics endpoint and SQLite event table in favour
of Matomo — a self-hosted, full-featured analytics platform.

k8s:
- Deploy MariaDB 11 + Bitnami Matomo 5 in the solitaire namespace
- Route analytics.aleshym.co ingress to the Matomo service
- Remove Datasette sidecar and its BasicAuth middleware/secret
- Remove the analytics port from the solitaire-server Service

Rust:
- Replace AnalyticsClient (custom HTTP endpoint) with MatomoClient (Matomo
  HTTP Tracking API bulk endpoint); maps game events to Matomo categories
- Add matomo_url + matomo_site_id fields to Settings (serde default → None/1)
- Privacy toggle in Settings now activates when matomo_url is set (not tied
  to SyncBackend::SolitaireServer)
- Remove POST /api/analytics route from solitaire_server

Web:
- Add Matomo JS tracking snippet to game.html (/play page)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

solitaire_engine/src/settings_plugin.rs

@@ -1682,8 +1682,8 @@ fn spawn_settings_panel(
             }
             import_themes_row(body, font_res);
 
-            // --- Privacy (only shown when a sync server is configured) ---
-            if matches!(settings.sync_backend, SyncBackend::SolitaireServer { .. }) {
+            // --- Privacy (only shown when a Matomo URL is configured) ---
+            if settings.matomo_url.is_some() {
                 section_label(body, "Privacy", font_res);
                 toggle_row(
                     body,
@@ -1691,7 +1691,7 @@ fn spawn_settings_panel(
                     AnalyticsEnabledText,
                     on_off_label(settings.analytics_enabled),
                     SettingsButton::ToggleAnalytics,
-                    "Sends anonymous game events to your server. No personal data is collected.",
+                    "Sends anonymous game events to Matomo for aggregate analytics.",
                     font_res,
                 );
             }