Add optional Sentry error monitoring

[dadachi]

Summary

Ports the optional Sentry error monitoring from the MyTurnTag API (sentry-ruby / sentry-rails 7.1.0, same gem versions) to the template.

• Off unless SENTRY_DSN is set. Without it Sentry.init is never called; development, test and any deploy without a DSN behave exactly as before.
• Production only, errors only. enabled_environments = %w[production]; tracing and profiling are off (nil, not 0.0), and breadcrumbs are disabled.
• Only real bugs. Exceptions the API answers with a 4xx are excluded: the rescue_from handlers in Api::V1::Shopkeeper::BaseController, sentry-rails' defaults, plus ActiveRecord::RecordInvalid, ActiveRecord::RecordNotDestroyed and Pundit::NotAuthorizedError (NativeapptemplateSentry::EXPECTED_EXCEPTIONS).
• No personal data. send_default_pii = false. The Sentry user is the shopkeeper's ID only, and the account ID is a tag (SetCurrentRequestDetails). before_send drops the devise_token_auth headers, masks email addresses in messages, exceptions and the URL, and applies filter_parameters to request data and extras.
• Kamal. SENTRY_DSN is an optional env.secret. .kamal/secrets reads it from NATIVEAPPTEMPLATEAPI_SENTRY_DSN; if that is unset, the container gets an empty value and Sentry stays off. Nothing was deployed.
• Docs. The README has a new "Error monitoring (Sentry)" section: how to turn it on, what is sent and what is excluded, and the recommended Sentry org settings: Prevent Storing of IP Addresses, plus an Advanced Data Scrubbing rule (Remove / Anything / $user.geo.**), because the IP setting alone doesn't drop geo. AGENTS.md and CHANGELOG are updated too.

No DSN or other secret is committed.

Tests

• test/config/sentry_test.rb: no init without a DSN (checked at boot, independent of test order); with a DSN, production-only, no PII, no tracing, profiling or breadcrumbs; expected exceptions excluded and real bugs allowed; before_send scrubbing.
• test/integration/sentry_context_test.rb: an unhandled error in a shopkeeper request is sent with user = {id:} and the account_id tag, with no email, name or auth headers; a 401 and handled 404s are not sent.
• test/config/deploy_config_test.rb: SENTRY_DSN is in env.secret and read from the app-prefixed variable.

I broke the code for each new test and confirmed it failed (18 breakages, each one red), then restored the code.

Verification

• bin/ci passes: rubocop, erb_lint, bundler-audit, brakeman, 614 tests / 1594 assertions, seeds.
• Development boot with no DSN: Sentry.initialized? == false, and capture_exception / set_user are no-ops.
• Production-like boot (RAILS_ENV=production) with a dummy DSN pointing at a local listener on 127.0.0.1: one envelope arrived. It had release = KAMAL_VERSION, user: {id} only, the account_id tag, only the Accept header, no query string, REMOTE_ADDR filtered and the email masked. The RecordInvalid captured in the same run was not sent.

🤖 Generated with Claude Code

https://claude.ai/code/session_01K5hZEFqXhBsUQwSWsgR6eH