refactor: share oauth callback analytics and civil hour-line walk

[cursor]

Behavior-preserving cleanup of merges after #4456/#4457 (#4459 OAuth signup analytics, #4460 DST grid alignment, #4466/#4472 boot-size deploy docs).

What and why

The OAuth callback GET and Apple form-post paths were capturing the same received/failed pair twice, and the DST grid added a second hour-line walk next to getHourLabels. This folds those into shared helpers, drops unused oauth-signup.events exports, records Apple/Provider SPA landings through one function, and sets TimedGrid geometry CSS variables once on the scroll region. Deploy docs now match Dockerfile.web: image builds do not run run-boot-size-check.sh.

No public behavior or analytics event names change.

Verify

VERDICT: FAIL on one e2e spec the diff does not change: e2e/timed/shift-hold-event-hints.spec.ts:70 toBeFocused under the full suite (18.9s). The same spec passed standalone (8.8s, 5/5). Sandbox flake documented on #4456; CI is the gate.

Checks run: test:core, test:web (658/658), test:backend:fast, type-check, lint, knip, test:a11y (65/65). Related specs this change can reach passed: keyboard-grid-parity ArrowDown opens the date picker; event-sidebar-staging description-link copy. test:e2e 245/246 under the full suite.

  

---

Note

Low Risk
Refactor with tests and explicit behavior-preserving intent; OAuth telemetry query removal is a minor API surface change on an internal callback route.

Overview
Consolidates OAuth signup analytics and DST-aware hour-line logic without changing event names or user-visible behavior.

OAuth: Apple and provider SPA callbacks now call recordOAuthSignInCallbackLanding (server relay, then oauth_callback_returned + oauth_callback_received). Backend GET and Apple form-post paths share captureOAuthCallbackQueryAnalytics; PostHog capture is deduplicated via captureOAuthSignupEvent. Telemetry-only callbacks accept only the X-Compass-OAuth-Telemetry header (the telemetry=1 query flag is removed). Unused oauth-signup.events exports are dropped; web/backend use shared event constants.

Calendar grid: New civilHourLineInstants drives getHourLabels, mappedHourLabels, and related grid math (minutesFromCivilMidnight in getYByDate). TimedGrid sets geometry CSS variables once on the scroll region instead of on nested layers.

Docs: performance-baselines.md now states deploy images run build.ts with production config and that boot gzip is enforced in PR CI, not at deploy.

^{Reviewed by Cursor Bugbot for commit 38e3cd5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Boot bundle: 507.6 KB gzip (-0.0 KB vs main)

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 38e3cd5. Configure here.}

[cursor]

Now-line uses host calendar date

Medium Severity

getCurrentPercentOfDay now passes an unzoned dayjs() into civilDayLengthMinutes. That helper reads the calendar date from its input without converting, so when the host timezone and timeZone fall on different dates the now-line uses the wrong day length, most visibly on a DST transition.

 

^{Reviewed by Cursor Bugbot for commit 38e3cd5. Configure here.}