- inject the Umami script at runtime only when VITE_UMAMI_SRC + VITE_UMAMI_WEBSITE_ID
are set (so dev/local traffic isn't tracked); website-id is public, not a secret
- web Dockerfile passes them as build args; docker-compose.prod.yml + env examples
document them (optional, empty = disabled)
Verified: build bakes the values in when set; skipped when unset.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
