Track friend additions in analytics

[PengfanZ]

What changed

• add a privacy-safe friend_added product event for successful local and Live additions
• count activity creation once when initial friends are supplied
• extend the Supabase analytics allowlist, database constraint, and reporting docs
• cover successful local/Live additions and failed Live saves across unit, pgTAP, and Playwright tests

User impact

The Home analytics data can now show how often people add friends and whether the action happened in a local or Live activity. One form submission counts once, even when several friends are added. Names, IDs, activity data, and friend counts are never sent.

Validation

• npm run typecheck
• npm run lint
• npm run test:coverage — 281 tests, 100% coverage
• npm run test:e2e — 13 passed
• npm run backend:reset
• npm run test:backend — 121 passed
• npx supabase db advisors --local --type all --level warn --fail-on error
• npm run build:pages
• production-mode local browser action verified the database row is friend_added | local | en with no currency and a hashed session token