Record ONE first-party analytics event. Write-only, fire-and-forget.

Security surface:

• per-IP rate limit (IMPORTANT-2): over _EVENTS_RATE_LIMIT/min from one IP → 429, checked FIRST and before any DB work, so a flood is cheap to reject (this is the first unauthenticated write route — nothing here should be able to exhaust the connect-per-request Postgres slots).
• anon_id is capped at _EVENT_ANON_ID_MAX_LEN chars (MINOR-1) — it's a client uuid, anything longer is garbage → 400.
• name must be in the server-side whitelist (_EVENT_NAMES) → else 400.
• props is size-capped (~1KB serialized) → oversized → 400.
• user_id is taken from the session cookie when present; NEVER trusted from the body. anon_id (a client localStorage uuid) attributes logged-out visitors. No PII beyond these ids is expected. The client fires this best-effort and ignores the result — a rejection here never blocks any UX.