TK-34: Record Matomo Analytics in Production

[burkkyy]

Fixes https://yg-hpw.atlassian.net/browse/TK-34

Context

Matomo analytics were reported as not recording for the production Vault:

I am unable to access Matomo analytics. The Traditional Know Vault section shows no analytics.

The Matomo tracking code was already integrated (SPA page-view tracking wired through the router), but it never recorded in production for two independent reasons:

1. The production build shipped with an empty tracker host — tracking is gated on VITE_MATOMO_HOST, which was not provided at build time, so the plugin no-opped.
2. The app's Content Security Policy did not allow the external tracker, so the matomo.js script and the matomo.php beacons would have been blocked even once enabled.

Implementation

1. Default the production tracker host to the Yukon Government analytics host so tracking is on in production without depending on a build-time environment variable (still overridable via VITE_MATOMO_HOST).
2. Allowlist the analytics host in the Content Security Policy so the tracker script loads and page-view beacons are sent.
3. Keep analytics disabled outside production (dev, UAT, and local runs remain off) so only the production Vault reports to Matomo site 115.

Screenshots

N/A - configuration changes only.

Testing Instructions

1. Run the test suite via dev test.
2. Boot the app via dev up.
3. Log in to the app at http://localhost:3000.
4. Note: analytics is production-only by design — local dev keeps Matomo disabled, so no beacons are sent while developing.
5. Confirm the server allowlists the tracker: any API response's Content-Security-Policy header includes https://analytics.gov.yk.ca in both script-src and connect-src.
6. To exercise the tracker locally, rebuild the web app with VITE_MATOMO_HOST=https://analytics.gov.yk.ca, load the app, navigate between pages, and verify in the browser Network tab that matomo.js loads and matomo.php requests fire with no CSP violations in the console.
7. In production, navigate the Vault and verify page views appear under Matomo site 115.