feat(web-vitals): restrict reporting to production, make endpoint configurable

[Petah1]

Closes #556

---

Summary

• Production-only reporting — all Core Web Vitals reporting is now guarded behind process.env.NODE_ENV === 'production'. In WebVitalsInit.tsx the useEffect returns early in non-production environments so no web-vitals listeners are registered and no visibility-change handler is attached. In webVitalsReporter.ts the ship function has the same guard as a defence-in-depth measure, ensuring the reporter never makes outbound requests even if it is called directly outside of the component.

• Configurable analytics endpoint — the hardcoded /api/v1/analytics/events URL has been replaced with process.env.NEXT_PUBLIC_ANALYTICS_ENDPOINT. The createWebVitalsReporter factory resolves the endpoint in priority order: options.endpoint (for tests/overrides) → NEXT_PUBLIC_ANALYTICS_ENDPOINT → empty string. The explicit options.endpoint escape-hatch keeps existing unit tests working without env-var changes.

• Clear dev warning — when NODE_ENV !== 'production' and NEXT_PUBLIC_ANALYTICS_ENDPOINT is not set, WebVitalsInit emits console.warn('[WebVitals] Core Web Vitals reporting is disabled: NEXT_PUBLIC_ANALYTICS_ENDPOINT is not set.') so the absence of reporting is explicit rather than silent.

• Graceful production degradation — if NEXT_PUBLIC_ANALYTICS_ENDPOINT is missing or empty in a production build, ship skips the fetch without throwing. Network failures continue to be caught and silently discarded, so analytics outages never surface as user-visible errors.

Files changed

File	Change
frontend/src/lib/webVitalsReporter.ts	Added IS_PRODUCTION constant; swapped hardcoded URL for NEXT_PUBLIC_ANALYTICS_ENDPOINT; added production guard and empty-endpoint guard in ship
frontend/src/components/providers/WebVitalsInit.tsx	Added production check + dev console.warn at the top of useEffect; registration block only runs in production

Behaviour matrix

Environment	NEXT_PUBLIC_ANALYTICS_ENDPOINT set?	Outcome
development / test	No	console.warn emitted; no listeners registered; no network calls
development / test	Yes	console.warn not emitted; still no listeners registered; no network calls
production	Yes	Metrics collected, buffered, and POSTed to the configured endpoint
production	No	Metrics collected and buffered; ship skips silently; no network call, no error

Test plan

• Run the dev server locally (npm run dev) with NEXT_PUBLIC_ANALYTICS_ENDPOINT unset — confirm console.warn appears in the browser console and no outbound requests are made to any analytics URL
• Run the dev server with NEXT_PUBLIC_ANALYTICS_ENDPOINT=http://localhost:9999/test set — confirm the warning is absent and still no network requests are made (non-production guard holds)
• Run existing webVitalsReporter unit tests — confirm they pass (tests pass options.endpoint explicitly so env-var default is bypassed)
• Build in production mode (NODE_ENV=production) with NEXT_PUBLIC_ANALYTICS_ENDPOINT set — confirm metrics reach the endpoint
• Build in production mode without NEXT_PUBLIC_ANALYTICS_ENDPOINT — confirm no unhandled errors and no network calls

[vercel]

@Petah1 is attempting to deploy a commit to the paul joseph's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Petah1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits