Phase 1 foundation: backend, web profile, and mobile app

Greenfield implementation of CardClaws Phase 1 across three surfaces.

Backend (Rust/Axum workspace, 67 tests):
- cardclaws-types/config/db/auth/api/wallet crates
- Auth: register, login + lockout, magic link, refresh rotation, Apple verify
- Cards: CRUD, tier-limited publish, duplicate, public handle lookup
- Assets: R2 presigned uploads; vCard export
- Apple Wallet .pkpass pipeline (PKCS#7 signer behind apple-signing feature)
- Analytics ingest + summary with daily-salted IP hashing
- Migrations 0001 (incl. cardclaws_sessions) + 0002 analytics

Web profile (Astro SSR): cardclaws.com/[handle] hero + flip, contact actions,
client-built vCard, visit attribution. Verified end-to-end.

Mobile (Expo SDK 51): auth, card list/create, builder v1 (bg/text/logo,
palette, undo/redo), Skia/Reanimated viewer (flip + ambient). 22 logic tests.

CI: policy/backend/profile/mobile jobs; LOC + no-placeholder lint.

Review fixes baked in: `back` (not `cardclaws`) key; strip image is a bundled
manifest file (not a URL); sessions table added; NFC reframed; test doubles
allowed for external services.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

cardclaws-backend/crates/cardclaws-api/src/handlers/analytics.rs

@@ -0,0 +1,69 @@
+//! Analytics handlers (PRD §13.5): client event ingest + owner summary.
+
+use axum::extract::{Path, State};
+use axum::http::HeaderMap;
+use axum::Json;
+use cardclaws_db::models::analytics::AnalyticsSummary;
+use serde::Deserialize;
+use serde_json::{json, Value};
+use uuid::Uuid;
+
+use crate::error::ApiResult;
+use crate::middleware::auth::AuthUser;
+use crate::services::analytics_service;
+use crate::state::AppState;
+
+#[derive(Deserialize)]
+pub struct IngestRequest {
+    pub card_id: Uuid,
+    pub event_type: String,
+}
+
+/// Public client-side event ingest (PRD §18.1 secondary path).
+pub async fn ingest_event(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Json(req): Json<IngestRequest>,
+) -> ApiResult<Json<Value>> {
+    let ip = client_ip(&headers);
+    let ua = header_str(&headers, "user-agent");
+    analytics_service::ingest_client_event(
+        &state,
+        req.card_id,
+        &req.event_type,
+        ip.as_deref(),
+        ua.as_deref(),
+    )
+    .await?;
+    Ok(Json(json!({ "status": "recorded" })))
+}
+
+/// Owner-only metrics summary for a card.
+pub async fn summary(
+    State(state): State<AppState>,
+    user: AuthUser,
+    Path(id): Path<Uuid>,
+) -> ApiResult<Json<AnalyticsSummary>> {
+    Ok(Json(
+        analytics_service::summary(&state, id, user.user_id).await?,
+    ))
+}
+
+/// Best-effort client IP from the proxy headers Cloudflare/Hetzner set. The
+/// first IP in `x-forwarded-for` is the original client.
+pub fn client_ip(headers: &HeaderMap) -> Option<String> {
+    header_str(headers, "cf-connecting-ip")
+        .or_else(|| {
+            header_str(headers, "x-forwarded-for")
+                .map(|xff| xff.split(',').next().unwrap_or("").trim().to_string())
+        })
+        .or_else(|| header_str(headers, "x-real-ip"))
+        .filter(|s| !s.is_empty())
+}
+
+pub fn header_str(headers: &HeaderMap, name: &str) -> Option<String> {
+    headers
+        .get(name)
+        .and_then(|v| v.to_str().ok())
+        .map(|s| s.to_string())
+}