feat: PostHog analytics wiring across all key screens

- Commit untracked posthog_service.dart (fire-and-forget HTTP client,
  EU data residency, already used by auth for identify/reset)
- screen() calls: Home, Contribute, Profile, EventDetail (with event_id)
- capture('event_tapped') on hero carousel card tap (source: hero_carousel)
- capture('book_now_tapped') in _navigateToCheckout (event_id + name)
- capture('review_submitted') in _handleSubmit (event_id + rating)
- Covers all 4 expansion items from security audit finding 8.2

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/core/analytics/posthog_service.dart

@@ -0,0 +1,94 @@
+// lib/core/analytics/posthog_service.dart
+import 'dart:convert';
+import 'dart:io' show Platform;
+import 'package:flutter/foundation.dart';
+import 'package:http/http.dart' as http;
+import 'package:shared_preferences/shared_preferences.dart';
+
+/// Lightweight PostHog analytics client using the HTTP API.
+/// Works with Dart 2.x (no posthog_flutter SDK needed).
+class PostHogService {
+  static const String _apiKey = 'phc_xXxn0COAwWRj3AU7fspsTuesCIK0aBGXb3zaIIJRgZA';
+  static const String _host = 'https://eu.i.posthog.com';
+  static const String _distinctIdKey = 'posthog_distinct_id';
+
+  static PostHogService? _instance;
+  String? _distinctId;
+
+  PostHogService._();
+
+  static PostHogService get instance {
+    _instance ??= PostHogService._();
+    return _instance!;
+  }
+
+  /// Initialize and load or generate a distinct ID.
+  Future<void> init() async {
+    final prefs = await SharedPreferences.getInstance();
+    _distinctId = prefs.getString(_distinctIdKey);
+    if (_distinctId == null) {
+      _distinctId = DateTime.now().millisecondsSinceEpoch.toRadixString(36) +
+          UniqueKey().toString().hashCode.toRadixString(36);
+      await prefs.setString(_distinctIdKey, _distinctId!);
+    }
+  }
+
+  /// Identify a user (call after login).
+  void identify(String userId, {Map<String, dynamic>? properties}) {
+    _distinctId = userId;
+    SharedPreferences.getInstance().then((prefs) {
+      prefs.setString(_distinctIdKey, userId);
+    });
+    _send('identify', {
+      'distinct_id': userId,
+      if (properties != null) '\$set': properties,
+    });
+  }
+
+  /// Capture a custom event.
+  void capture(String event, {Map<String, dynamic>? properties}) {
+    _send('capture', {
+      'event': event,
+      'distinct_id': _distinctId ?? 'anonymous',
+      'properties': {
+        ...?properties,
+        '\$lib': 'flutter',
+        '\$lib_version': '1.0.0',
+      },
+    });
+  }
+
+  /// Capture a screen view.
+  void screen(String screenName, {Map<String, dynamic>? properties}) {
+    capture('\$screen', properties: {
+      '\$screen_name': screenName,
+      ...?properties,
+    });
+  }
+
+  /// Reset identity (call on logout).
+  void reset() {
+    _distinctId = null;
+    SharedPreferences.getInstance().then((prefs) {
+      prefs.remove(_distinctIdKey);
+    });
+  }
+
+  /// Send event to PostHog API (fire-and-forget).
+  void _send(String endpoint, Map<String, dynamic> body) {
+    final payload = {
+      'api_key': _apiKey,
+      'timestamp': DateTime.now().toUtc().toIso8601String(),
+      ...body,
+    };
+
+    // Fire and forget — don't block the UI
+    http.post(
+      Uri.parse('$_host/$endpoint/'),
+      headers: {'Content-Type': 'application/json'},
+      body: jsonEncode(payload),
+    ).catchError((e) {
+      if (kDebugMode) debugPrint('PostHog error: $e');
+    });
+  }
+}