monitoring: Betriebsüberwachung Phase 1 — GlitchTip (Server- und Browserfehler), Fehlersignale ohne Exception, /health mit Scheduler-Herzschlag, ntfy-Alarme, fehlgeschlagene Anmeldungen im Verlauf, Umami im Kundenbereich, Versionsnummer

- GlitchTip über die Sentry-SDKs; Datenschutzfilter (nur User-ID, keine
  Request-Bodys, Tokens aus URL/Query/Referer, E-Mails aus Meldungen).
  Browser-SDK erst beim ersten Fehler nachgeladen.
- ReportErrorSignals: tote interne Links (404 mit eigenem Referrer), 403/429
  für Angemeldete, 419 als gedrosselte Warnung.
- /health (Bearer-Token): DB, Cache, Queue-Rückstau, Scheduler-Herzschlag,
  Plattenplatz → 200/503; Scheduler und Plattenplatz auch im Systemstatus.
- OperationalAlert zusätzlich per ntfy (JSON-POST), unabhängig von der Mail.
- Verlauf: login_failed (Grund unbekannt/kein Passwort/falsch),
  login_lockout, two_factor_failed; IP nur als gekürzter HMAC.
- Umami: Kundenbereich mit eigenem Schalter und identify('user-<id>'),
  nie im Admin/bei Impersonation; Query-Filter auch auf den Webseiten
  (signierte Links gingen bisher an Umami).
- queue:prune-failed nach 30 Tagen.
- Versionsnummer: config('app.version') aus APP_VERSION oder Datei RELEASE
  (git describe --tags), in GlitchTip, /health, Systemstatus, artisan about.

Plan: dev/betrieb/monitoring-plan.md (Entscheidungen M1–M9).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Feature/Web/UmamiSnippetTest.php

@@ -1,5 +1,8 @@
 <?php
 
+use App\Actions\Admin\UserImpersonation;
+use App\Models\User;
+use Database\Seeders\RolesAndPermissionsSeeder;
 use Tests\TestCase;
 
 test('the umami snippet stays off until the go-live switch is set', function () {
@@ -27,3 +30,78 @@ test('the umami snippet renders the website id of the requested brand', function
     'businessportal24' => ['businessportal24.test', 'f03a5fc3-ac44-488f-9118-84004861099f'],
     'pressekonto hub' => ['pressekonto.test', 'ca440b65-a5bd-42c1-8cdb-96f34734003c'],
 ]);
+
+test('the web snippet carries the query filter, web vitals and no identity', function () {
+    /** @var TestCase $this */
+    config()->set('services.umami.enabled', true);
+    config()->set('services.umami.identify_users', true);
+    $this->actingAs(User::factory()->create());
+
+    $this->get('https://presseecho.test/de/faq')
+        ->assertSuccessful()
+        ->assertSee('data-tag="web"', false)
+        ->assertSee('data-before-send="pkUmamiBeforeSend"', false)
+        ->assertSee('window.pkUmamiBeforeSend', false)
+        ->assertSee('data-performance="true"', false)
+        ->assertDontSee('umami.identify', false);
+});
+
+/**
+ * Kundenbereich (Monitoring-Plan M2, M6, M7).
+ */
+function umamiCustomer(): User
+{
+    test()->seed(RolesAndPermissionsSeeder::class);
+    $customer = User::factory()->create(['is_active' => true]);
+    $customer->assignRole('customer');
+
+    return $customer;
+}
+
+test('the customer area is tracked only with its own switch', function () {
+    /** @var TestCase $this */
+    config()->set('services.umami.enabled', true);
+    config()->set('services.umami.portal_enabled', false);
+    $this->actingAs(umamiCustomer());
+
+    $this->get(route('me.dashboard'))->assertSuccessful()->assertDontSee('sys.adametz.media', false);
+
+    config()->set('services.umami.portal_enabled', true);
+
+    $this->get(route('me.dashboard'))
+        ->assertSuccessful()
+        ->assertSee('data-tag="portal"', false)
+        ->assertSee('data-website-id="ca440b65-a5bd-42c1-8cdb-96f34734003c"', false)
+        ->assertDontSee('umami.identify', false);
+});
+
+test('customers are identified by user id only when identify is switched on', function () {
+    /** @var TestCase $this */
+    config()->set('services.umami.enabled', true);
+    config()->set('services.umami.portal_enabled', true);
+    config()->set('services.umami.identify_users', true);
+    $customer = umamiCustomer();
+    $this->actingAs($customer);
+
+    $this->get(route('me.dashboard'))
+        ->assertSuccessful()
+        ->assertSee("window.umami.identify('user-{$customer->id}')", false)
+        ->assertDontSee("identify('{$customer->email}", false);
+});
+
+test('the admin area and impersonated sessions are never tracked', function () {
+    /** @var TestCase $this */
+    config()->set('services.umami.enabled', true);
+    config()->set('services.umami.portal_enabled', true);
+    config()->set('services.umami.identify_users', true);
+    $customer = umamiCustomer();
+    $admin = User::factory()->create(['is_active' => true, 'is_super_admin' => true]);
+
+    $this->actingAs($admin)->get(route('dashboard'))->assertSuccessful()->assertDontSee('sys.adametz.media', false);
+
+    $this->actingAs($customer)
+        ->withSession([UserImpersonation::SessionKey => $admin->id])
+        ->get(route('me.dashboard'))
+        ->assertSuccessful()
+        ->assertDontSee('sys.adametz.media', false);
+});