Add Umami page-view tracking

Uses st.html(..., unsafe_allow_javascript=True) rather than
components.html: the latter sandboxes content in its own iframe, so
Umami would only ever see a meaningless iframe-scoped page instead of
real top-level pageviews. Guarded by an element id so a Streamlit
rerun (which happens on every interaction, not just navigation) never
injects a duplicate script tag or fires an extra pageview beacon.
Website ID/script URL are plain constants, not secrets -- they're
visible in any page's source regardless.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app.py

@@ -13,9 +13,12 @@ import streamlit as st
 
 import google_oauth
 import token_store
+from analytics import inject_umami
 
 st.set_page_config(page_title="Board Game Tracker", layout="wide")
 
+inject_umami()
+
 
 def _drive_redirect_uri() -> str:
     return st.secrets["auth"]["redirect_uri"].removesuffix("/oauth2callback")

src/analytics.py

@@ -0,0 +1,33 @@
+import streamlit as st
+
+# Not sensitive -- an analytics site ID is plain HTML visible in any page's
+# source, so this lives as a code constant rather than a secret/env var.
+_UMAMI_SCRIPT_URL = "https://umami-acsk4kc0kw04o4ww4gosgoos.c.ai-man.cc/script.js"
+_UMAMI_WEBSITE_ID = "ae40c7e5-ca49-4786-b185-e0a90f337e55"
+_SCRIPT_TAG_ID = "umami-analytics-script"
+
+
+def inject_umami() -> None:
+    """Injects the Umami tracking script into the page.
+
+    st.html renders directly into the top-level DOM (unlike
+    components.html, which sandboxes content in its own iframe -- Umami
+    would then only ever see a meaningless "iframe page" instead of real
+    pageviews). Guarded by an element id so a Streamlit rerun never injects
+    a second copy or fires a duplicate pageview.
+    """
+    st.html(
+        f"""
+        <script>
+        if (!document.getElementById('{_SCRIPT_TAG_ID}')) {{
+            var s = document.createElement('script');
+            s.id = '{_SCRIPT_TAG_ID}';
+            s.defer = true;
+            s.src = '{_UMAMI_SCRIPT_URL}';
+            s.setAttribute('data-website-id', '{_UMAMI_WEBSITE_ID}');
+            document.head.appendChild(s);
+        }}
+        </script>
+        """,
+        unsafe_allow_javascript=True,
+    )