rum: fleet RUM init as the ./rum subpath entry (0.47.0, planning#1179 P2)

[ditto-m]

Summary

P2 of the fleet RUM initiative (ADR concepts/fleet-rum, etamong-playground/planning#1179): the fleet wrapper as a new ./rum subpath export (precedent: ./helpers, ./testing), released as 0.47.0.

• initRum({ app, version, apiKey, endpoint?, sessionSampleRate? }) — wraps @grafana/faro-web-sdk with the fleet policy baked in: default web instrumentations (errors/rejections, console-error, web vitals, session, view), no-PII (no setUser path at all), pagehide/visibilitychange/freeze breadcrumbs (the planning#1176 crash-vs-discard classifier), 1s batch flush so a discarded PWA tab's last events still ship, session sampling default 1.0. SSR-safe + idempotent.
• pushApiError(err) — wire as createFetch's onError; extracts the 8-hex ref/status/url so client events and server request failed lines share one Loki grep surface. Detection is structural (name === "HttpError"), NOT instanceof: subpath bundles hold separate copies of the class, so instanceof would silently never match — caught during implementation, covered by a test.
• @grafana/faro-web-sdk >=2.9.0 is an optional peerDependency and external in tsup — non-adopters install and bundle nothing.
• 7 unit tests (init policy, idempotency, overrides, breadcrumbs, ref extraction); typecheck + build green; README section added.

요약

fleet RUM wrapper를 ./rum subpath로 추가 (0.47.0). initRum = Faro 초기화 + fleet 정책(no-PII, lifecycle breadcrumb, 1s flush), pushApiError = createFetch onError에 연결하면 서버 ref 코드와 단일 grep surface. faro-web-sdk는 optional peer라 미채택 앱은 아무것도 설치/번들하지 않습니다.

Merge → auto-release가 v0.47.0을 cut/publish합니다 (ci-cut-releases). 채택 순서상 P1 collector(homelab-infra#242)가 먼저 살아있을 필요는 없습니다 — SDK는 POST 실패를 조용히 무시합니다.

Relates to etamong-playground/planning#1179. ADR: etamong-playground/planning#1180.

[ditto-m]

Round 2 review fix — a real always-on PII leak found and closed. The security verifier traced (in the installed SDK source) that Faro stamps the live location.href onto meta.page.url for every event — exceptions, web vitals, our own lifecycle breadcrumbs — so a URL like /reset?token=…&email=… would ship the query string to the shared collector continuously. captureConsole:false and pushApiError's own stripQuery did not cover this SDK-level meta.

Fix: an initializeFaro beforeSend hook (the one place that sees all outbound items) strips the query/fragment off meta.page.url. Covered by a new test; 123/123 pass. Also folded in: dropped a stray .tmp/pr-body.md and gitignored .tmp/, and rebuilt the branch as two clean commits (feature at 0.46.0 + release: 0.47.0) so the merge auto-publishes once with a CHANGELOG trail.

Verified-and-held from round 2: batching:{enabled:false} still ships web-vitals (instant send), captureConsole:false leaves error/web-vitals capture on, stripQuery handles the URL edge cases. Errors-instrumentation error.message and CSP URL fields remain app-author guidance (don't put PII in thrown messages), not wrapper-fixable.

Held (not merging): this depends on the ADR (planning#1180) review — won't publish 0.47.0 before the design is ratified.