feat(flags): decouple analytics capture from flag evaluation (POSTHOG_CAPTURE_ENABLED)

So a non-prod env can hold the (public) project key and evaluate flags - kill
switches, rollout - WITHOUT shipping analytics events to the shared prod
PostHog project. The posthog-node client (which powers both capture and local
flag eval) now initializes whenever the project key is present; capture() is
gated on POSTHOG_CAPTURE_ENABLED (default on; set "false" on dev). Wired into
the api + worker compose blocks.

This lets dev.sase.tr exercise the kill switches end-to-end while keeping the
prod analytics project clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/config/src/index.ts

@@ -103,6 +103,11 @@ export const envSchema = z.object({
   // remote-config ops tuning. Without it those flags fail open (no effect, no
   // added latency). Keep secret — never expose to the browser.
   POSTHOG_PERSONAL_API_KEY: z.string().optional(),
+  // Gate server-side analytics CAPTURE independently of flag evaluation, so a
+  // non-prod env can evaluate flags (kill switches, rollout) while the project
+  // key is set WITHOUT shipping events to the shared prod project. Default on;
+  // set "false" on dev. (Plain string — read as `!== "false"`.)
+  POSTHOG_CAPTURE_ENABLED: z.string().optional(),
 
   // Sentry — error tracking
   SENTRY_DSN: z.string().url().optional(),