Track Event

First-party funnel analytics. Unauthenticated, on purpose — anonymous visitors are the point, so there's no get_current_user_id dependency.

Accepted risk: there is no rate limiting anywhere in this backend, so this endpoint is spammable. Inserts are cheap and the table is operator-read-only, so poisoning is an annoyance, not a breach — rate limiting is future backend work, not part of this change.

Always 204: an unknown/non-allowlisted name is silently dropped rather than erroring (a 4xx here would be console noise on every page load), and a DB failure is logged, not raised, so analytics never surfaces an error to a visitor. Malformed JSON bodies still 422 via FastAPI's normal request validation, which is unchanged.