Launch hardening

PostHog product events now cover signup, onboarding, project creation, strategy generation, submissions, upgrades, and checkout completion.

Security headers and a report-only Content Security Policy are configured for production traffic.

Account export and soft-delete controls are available from Settings.