Harden static telemetry bootstrap and remove committed Kubiks key

[Copilot]

The Copilot-added telemetry integration introduced static-site regressions and committed a Kubiks credential into the repo. This change narrows telemetry startup to explicit opt-in and moves credential injection to runtime-only configuration.

• Telemetry bootstrap

  • Gate otel-init.js behind explicit opt-in in index.html
  • Default app load no longer pulls telemetry code for normal static launches
  • Telemetry now starts only when both enablement and a runtime key are present

• Credential handling

  • Remove the committed Kubiks key from browser code
  • Replace browser-side process.env usage with runtime lookup from:
    • ?kubiksKey=...
    • localStorage['fastcash.telemetry.kubiksKey']

• Initialization behavior

  • Keep otel-init.js safe for direct import in the browser
  • Skip exporter registration cleanly when no runtime key is configured
  • Limit console span exporter usage to local debugging conditions

• Documentation

  • Update TELEMETRY_SETUP.md to describe the static-app flow accurately
  • Document the required opt-in flag and runtime key pairing
  • Remove guidance that implied committed or build-time browser secrets

<script type="module">
  const params = new URLSearchParams(window.location.search);
  const telemetryEnabled =
    params.get('telemetry') === '1' ||
    window.localStorage.getItem('fastcash.telemetry') === 'enabled';

  if (telemetryEnabled) {
    import('./otel-init.js').catch(err =>
      console.error('Failed to initialize OpenTelemetry:', err)
    );
  }
</script>

• UI
  • No functional UI redesign; app behavior remains unchanged for default users while telemetry becomes an explicit runtime opt-in

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[Copilot]

Pull request overview

This PR hardens the static-site OpenTelemetry bootstrap by making telemetry explicitly opt-in at runtime and removing the previously committed Kubiks credential from browser code.

Changes:

• Gate otel-init.js loading behind an explicit telemetry enablement flag in index.html.
• Move Kubiks key lookup to runtime-only configuration via query param and/or localStorage, and skip exporter registration when missing.
• Update TELEMETRY_SETUP.md to describe the new opt-in + runtime-key flow and remove build-time secret guidance.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
otel-init.js	Reads Kubiks key at runtime, avoids committed secrets, and conditionally registers exporters/provider.
index.html	Dynamically imports telemetry init only when telemetry is explicitly enabled.
TELEMETRY_SETUP.md	Updates setup documentation for the opt-in runtime configuration model.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.