feat: route normalized OTLP signals to project destinations

[tgmendes]

Builds on the data-export management API merged in #5792.

Summary

• Add an active-route lookup to the dataexports repository and reuse its project-scoped destination model.
• Relay normalized OTLP logs, metrics, and traces through the selected destination, including encrypted headers and destination-level sensitive-data policy.
• Treat enabled product-telemetry routes as the authoritative replacement for the removed global PostHog forwarding kill switch.
• Count normalized records with missing or malformed project IDs as invalid and drop them before route lookup or export.

Sensitive data policy

This is, for now, a somewhat naive policy, but I think will suffice. Over time we might need to revisit how we do proper redaction.

• include preserves the normalized OTLP payload.
• exclude replaces classified content and identity values with [REDACTED] across log, metric, and trace containers while preserving attribute keys.
• Destinations configured to include sensitive data are reloaded for every delivery, so an include-to-exclude policy change cannot remain stale in the destination cache.

Motivation

Normalized telemetry must follow the project-scoped routes managed by the data export API. Resolving destinations at the normalized signal boundary keeps logs, metrics, and traces consistent while preserving project isolation and destination-specific disclosure policy.

NOTE

Once this is merged the old configs will stop working: this is ok. Only one customer has it configured other than us, and it's not working (all datadog logs are showing 403 failures). I have shared this with them so they are aware.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 561090f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cubic-dev-ai]

Running ultrareview automatically — This large change introduces project-scoped OpenTelemetry exports with new authorization, write-only header secret handling, and a sensitive-data telemetry relay—security and data-integrity bugs here would have broad blast radius.. I'll post findings when complete.

[cubic-dev-ai]

Ultrareview completed in 14m 45s

All reported issues were addressed across 119 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 21 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>