dev/index.html injects a GoatCounter beacon by default — every visitor of every self-hosted deployment is reported; please make it opt-in

[chertsa]

deploy/dev/index.html (still present at current master 5b48490) appends a GoatCounter
script on every load unless ?embedded=true:

var gc=document.createElement('script');gc.dataset.goatcounter='https://red1oon.goatcounter.com/count';
gc.async=true;gc.src='//gc.zgo.at/count.js';document.body.appendChild(gc);

For your own hosted demo that is entirely reasonable. But the same file is what everyone
self-hosts, so every visitor of every downstream deployment is reported to your analytics
account by default — engineering firms' staff and their clients included, with no deployer
having chosen it. For any deployment subject to GDPR-style rules it is also a compliance
problem the deployer cannot see coming.

The ?ignore-me / localStorage opt-out exists, but it is per-browser and undiscoverable —
a deployer cannot switch it off for their site.

Suggested fix: gate it on something a deployer controls — e.g. only inject when
location.hostname matches your own deployment, or read the goatcounter code from a config
that ships empty. One guarded line, and downstream deployments are clean by default while your
demo keeps its stats.

(Downstream we currently strip it at the serving layer; reporting so the default itself can be
fixed at the source.)