Add frontend error collector, CORS/ingest guards, and static doc routes (Phase 3)

- Add static/otel-rum.js: a framework-free browser script that captures
  uncaught errors, unhandled promise rejections and failed resource loads,
  translating them into OTLP log records POSTed to the existing /v1/logs
  endpoint (source: frontend attribute) so they flow through the same
  history/search/issue pipeline as backend telemetry.
- Add correlation-id support: traceHeaders() (manual) and same-origin
  fetch auto-instrumentation inject a W3C traceparent header, so a
  frontend error and the backend spans it triggered share a trace id and
  can be found together via GET /api/traces/{traceId}.
- Add CORS handling (withCORS in cmd/server/main.go) on the OTLP HTTP
  endpoints, required for any browser-origin POST.
- Add an optional shared ingest key (OTEL_INGEST_KEY, via '?key=' or
  X-Otel-Ingest-Key) and a per-IP rate limit (20 rps/burst 50) on OTLP
  HTTP ingestion, to scope/protect a public endpoint fed by a browser
  script. Verified end-to-end (CORS preflight, cross-origin POST, ingest
  key enforcement, rate limiting) against a running server.
- Serve static/otel-rum.js and agents_example.md as static HTTP routes so
  both the script and the agent instructions doc are fetchable directly
  from the base URL.
- Ignore the separately-cloned otel-ui/ frontend repo (has its own .git;
  not meant to be nested into this repo's history).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/PLAN.md

@@ -34,14 +34,24 @@ Sentry-like frontend error collector.
 
 ## Phase 3 — Frontend error collector (Sentry-style)
 
-- [ ] `static/otel-rum.js`: captures `window.onerror`,
+- [x] `static/otel-rum.js`: captures uncaught errors,
       `unhandledrejection`, resource load failures; translates them to OTLP
       log records client-side and POSTs to the existing `/v1/logs` endpoint
       (so Phase 2's issue derivation picks them up for free via a
-      `source: frontend` attribute).
-- [ ] CORS support on the OTLP HTTP endpoints (currently absent — required
-      for any browser-origin POST).
-- [ ] Lightweight ingest key for scoping/rate-limiting noisy pages (not
-      real auth).
-- [ ] Explicitly out of scope for v1: source map resolution, session
-      replay, PII scrubbing.
+      `source: frontend` attribute). Verified end-to-end against a running
+      server: an ingested frontend error shows up in `GET /api/issues` and
+      `GET /api/traces/{traceId}`.
+- [x] Correlation-id injection: `traceHeaders()` (manual) and
+      auto-injection into same-origin `fetch` calls, using a W3C
+      `traceparent` header so a backend span sharing that trace id and the
+      frontend error that triggered it show up together via
+      `/api/traces/{traceId}`.
+- [x] CORS support on the OTLP HTTP endpoints (`withCORS` in
+      `cmd/server/main.go`), verified with a live cross-origin POST.
+- [x] Lightweight ingest key (`OTEL_INGEST_KEY`, checked via
+      `Collector.checkIngest`) for scoping noisy pages, plus a per-IP rate
+      limit (20 rps/burst 50) on the OTLP HTTP ingestion endpoints so a
+      runaway error loop can't hammer the collector. Not real auth.
+- [x] Explicitly out of scope for v1: source map resolution, session
+      replay, PII scrubbing (documented in README.md and the script's
+      header comment).