fix(frontend): strip fragments from analytics URLs

[cursor]

Motivation

Personal-note share links keep the decryption key in the URL fragment (#k=...) so the key is never sent to the canister or leaked through referrers. Plausible's tracker uses location.href for event URLs by default, so opening /notes/share/<token>#k=<key> could attach the share key to pageview and recipient analytics payloads.

Existing work checked: recently merged note-share PRs #13299, #13300, #13303, #13321, #13353, the open security-model docs PR #13366, open/recent analytics PRs, and related issues. The docs and PR descriptions confirm the key/token must not be exposed in analytics, but none of the active work sanitizes Plausible's auto-attached URL.

Changes

• Add a central Plausible transformRequest that strips URL fragments from every analytics payload URL before it is sent.
• Preserve the path/query and all other payload fields.
• Cover the privacy invariant in the analytics service tests.

Tests

• npm run test -- --run src/frontend/src/tests/lib/services/analytics.service.spec.ts
• npm run format
• npm run lint -- --max-warnings 0
• npm run check
• npm run test
• npm run check:tests
• npm run lint:lockfile