feat: Add Phase 11 analytics and production readiness features

- Introduced new endpoints for account overview, analytics, and metrics.
- Implemented authorization matrix and backup/restore documentation.
- Added smoke test script and updated package dependencies.
- Created detailed production checklist and runbook for deployment.
- Established cron operations and notification event matrix documentation.
- Enhanced security and validation audits for analytics and metrics services.
- Added unit tests for analytics and metrics functionalities.

tests/unit/phase11-analytics-security.test.js

@@ -0,0 +1 @@
+const analytics=require("../../app/services/analytics/analytics.service"),metrics=require("../../app/services/metrics.service"),permissions=require("../../app/constants/permissions");describe("Phase 11 bounded analytics and observability",()=>{test("defaults analytics to a bounded 30 day UTC range",()=>{const r=analytics.range({},366);expect(r.to-r.from).toBe(29*86400000);});test("rejects reversed dates",()=>expect(()=>analytics.range({from:"2026-02-02",to:"2026-01-01"})).toThrow("Date range"));test("rejects ranges over one year",()=>expect(()=>analytics.range({from:"2024-01-01",to:"2026-01-01"})).toThrow("Date range"));test("metrics use bounded method and status-class labels",()=>{metrics.observe("GET",200,0.01);metrics.observe("POST",503,0.02);const body=metrics.render();expect(body).toContain('method="GET",status_class="2xx"');expect(body).toContain('method="POST",status_class="5xx"');expect(body).not.toMatch(/userId|orderId|email|ticketId|productId/);});test("analytics permissions are separated by domain",()=>expect([permissions.ANALYTICS_DASHBOARD_READ,permissions.ANALYTICS_PAYMENTS_READ,permissions.SYSTEM_METRICS_READ]).toEqual(["analytics.dashboard.read","analytics.payments.read","system.metrics.read"]));});