Opt-in crash & error reporting via Sentry (sentry-tauri)

[sam-powers]

Why

To answer "are people running into bugs?" without a server, we need errors to phone home — but only with consent. Builds on the local diagnostics foundation (#54).

Scope

• sentry-tauri (https://github.com/timfish/sentry-tauri) — confirmed Tauri v2. Captures JS errors, Rust panics, and native minidump crashes, with browser events enriched by Rust/OS/device context and merged breadcrumbs. The Rust-side capture matters: Quill's likeliest silent failures are in the IPC layer (file I/O, claude spawn), which JS-only tools miss.
• Consent model (non-negotiable for a local-first OSS tool aimed at technical users):
  • Opt-in, off by default. Nothing sent until the user explicitly enables it.
  • One-time first-run prompt + a Settings toggle.
  • Respect DO_NOT_TRACK=1.
  • Be explicit about what's sent.
• PII / path scrubbing in beforeSend — stack traces and breadcrumbs can carry file paths or document snippets. Strip/anonymize before send.
• Decide cloud Sentry (free tier ~5k errors/mo) vs. self-host (Sentry is self-hostable).

Out of scope

Usage/feature analytics — that's a separate question (Aptabase), file later if wanted. This issue is errors/crashes only.

Depends on

#54 (local logging + panic hook) lands first.