analytics: fix the two FRE-369 findings in the funnel instrumentation

The security review of 39d874a (FRE-369) found the address fix recorded
the wrong thing twice. Both are fixed here; the branch is the same one
under review, this commit does not rewrite it.

Q1 — the first x-forwarded-for hop is attacker-chosen text. In
client → Cloudflare → same-host proxy → app, both proxies *append*, so
the header arrives as `<client spoof…>, <true client>, <CF edge>` and
`split(",")[0]` took the sender's own invention — the loopback-peer gate
was sound, the hop selection defeated it. Preference is now
`cf-connecting-ip` (Cloudflare overwrites it, so a client value never
survives the edge), then x-forwarded-for counted from the right with one
trusted hop discounted, then the direct peer. Every candidate must parse
as an address. h3's `getRequestIP(…, { xForwardedFor: true })` has the
same leftmost flaw and is documented as not a fix.

Q4 — the table held full client addresses indefinitely. Every analytics
entry now passes through `truncateIpAddress` in `enrichAnalyticsEntry`
(IPv4 /24, IPv6 /56, unparseable dropped), so no writer can persist a
full address by accident. Retention got the schedule it never had:
`/api/analytics/retention` on a daily Vercel cron, Bearer-authenticated
and fail-closed, with the window parameterised (the old
`cleanupOldAnalytics` spliced the number into the SQL). Default 365 days
rather than the review's 90 so enabling the cron is not itself a
destructive event — the tighter window is an operational decision, named
on the task.

Also from the review: the module doc now forbids feeding this helper into
any security decision; `isLoopbackAddress` parses instead of
string-matching (`::ffff:127.9.9.9`, `0:0:0:0:0:0:0:1`); and `host` is
normalised (lowercased, port stripped) so `nook.freno.me:443` cannot
silently miss the `host = ?` scope. The weekly loopback caveat matches
the truncated shapes writers produce now, and says plainly that "unique
visitors" counts prefixes.

src/server/weekly-metrics.ts

@@ -144,8 +144,16 @@ export interface WeeklyReport {
   generatedAt: string;
 }
 
-/** Loopback addresses — every row the live table has ever held. */
-const LOOPBACK = ["127.0.0.1", "::1", "::ffff:127.0.0.1"];
+/**
+ * A recorded address that is not a visitor, in every spelling the column can
+ * hold: the proxy the request came through (`127.0.0.1`, `::1`, an IPv4-mapped
+ * form) *and* the prefixes the FRE-369 privacy floor writes instead of them
+ * (`127.0.0.0`, all-zero IPv6). Whole `127/8` because truncation keeps the first
+ * three octets, so `127.0.53.1` and `127.0.53.0` are the same non-visitor.
+ */
+const LOOPBACK_SQL = `(ip_address LIKE '127.%'
+     OR ip_address LIKE '::ffff:127.%'
+     OR ip_address IN ('::1', '0:0:0:0:0:0:0:1', '0:0:0:0:0:0:0:0'))`;
 
 /** SQLite's `datetime()` string, UTC: `YYYY-MM-DD HH:MM:SS`. */
 export function sqlTime(date: Date): string {
@@ -320,7 +328,6 @@ export async function readTraffic(
 ): Promise<WindowTraffic> {
   const { analytics } = conns;
   const { start, end } = window;
-  const placeholders = LOOPBACK.map(() => "?").join(", ");
 
   const analyticsRows = await countInWindow(
     analytics,
@@ -351,8 +358,8 @@ export async function readTraffic(
     `SELECT COUNT(*) AS n FROM VisitorAnalytics
      WHERE created_at >= ? AND created_at < ?
      AND host IS NOT NULL
-     AND ip_address IN (${placeholders})`,
-    [start, end, ...LOOPBACK]
+     AND ${LOOPBACK_SQL}`,
+    [start, end]
   );
 
   const downloadRows = await scalar(
@@ -595,7 +602,9 @@ export function renderWeeklyMarkdown(report: WeeklyReport): string {
         `(127.0.0.1 / ::1) — the writers then recorded the direct peer, not the visitor. ` +
         `They are excluded from every host-scoped stage above (visits, and the download ` +
         `click/served split), and "unique visitors" over them still collapses to one host. ` +
-        `Rows recorded since carry the real client address and the site they addressed.`
+        `Rows recorded since carry the site they addressed and the visitor's address ` +
+        `truncated to a prefix (/24, or /56 for IPv6 — the FRE-369 privacy floor), so ` +
+        `"unique visitors" counts networks, not machines.`
     );
   }
 
@@ -603,8 +612,8 @@ export function renderWeeklyMarkdown(report: WeeklyReport): string {
     lines.push(
       `- **${traffic.hostLoopbackRows} rows recorded since the instrumentation still carry a ` +
         `loopback address** — the forwarded-header fix is not taking effect in production ` +
-        `(or the proxy is not setting \`x-forwarded-for\`). Do not trust per-channel reach ` +
-        `until this is zero.`
+        `(no \`cf-connecting-ip\`, and no usable \`x-forwarded-for\` hop). Do not trust ` +
+        `per-channel reach until this is zero.`
     );
   }