Sentry plumbing, inert until a DSN exists

Server: errors-only @sentry/node behind SENTRY_DSN, capturing the
unhandled-protocol catch with its message type and room. Client:
errors-only @sentry/browser behind VITE_SENTRY_DSN baked at build.
Backup: Sentry Crons check-ins (in_progress/ok/error) when
/root/.wizwar-sentry-cron holds the check-in URL. No DSN, no behavior.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015RCWSTnb1KYTPyL4GmhGnF

packages/web/package.json

@@ -10,6 +10,7 @@
     "typecheck": "svelte-check --tsconfig ./tsconfig.json"
   },
   "dependencies": {
+    "@sentry/browser": "^10.73.0",
     "@wizwar/engine": "*"
   },
   "devDependencies": {

packages/web/src/main.ts

@@ -1,4 +1,11 @@
 import { mount } from "svelte";
+import * as Sentry from "@sentry/browser";
+
+// Errors only — no tracing, no replay. Without a DSN baked at build time
+// (VITE_SENTRY_DSN in .env.production) this is entirely inert.
+if (import.meta.env.VITE_SENTRY_DSN) {
+  Sentry.init({ dsn: import.meta.env.VITE_SENTRY_DSN, environment: "production" });
+}
 
 // /watch/<id> is the public share page — one turn, anyone may look. It
 // loads its own component so the full app (and its live socket appetite)