observability(ui): add browser Sentry with private source maps

[JSONbored]

Part of #998. Related: #982.

Context

The operator UI can fail in ways the Node/REES runtimes never see: route errors, hydration/client exceptions, failed dashboard data loads, and extension-adjacent browser behavior. Browser-side Sentry would make those visible, but it must be privacy-first and must not expose source maps publicly.

Session Replay is explicitly out of scope for the first pass unless we decide it is worth the privacy and noise tradeoff later.

Requirements

• Add browser Sentry only behind explicit env/config. No DSN means no SDK init and no event traffic.
• Upload UI source maps to Sentry from maintainer deploy/release workflows only; do not serve source maps publicly.
• Use the exact deployed UI release id for SDK events and source-map upload.
• Capture route errors, unhandled browser exceptions, and failed app-level resource loads where useful.
• Add strict beforeSend scrubbing for headers, cookies, auth/session details, request bodies, and any review/private config content.
• Add safe tags such as route, release, environment, and app surface; avoid high-cardinality or sensitive tags.
• Do not enable Session Replay in this issue.

Deliverables

• UI Sentry initialization path with no-op behavior when disabled.
• Source-map upload workflow for the UI build artifact.
• Error boundary or route-level capture where appropriate.
• Tests for no-DSN behavior and event scrubbing.
• Documentation for enabling browser Sentry and verifying source-map symbolication.

Acceptance criteria

• A controlled browser error in production maps back to the original TypeScript/TSX source in Sentry.
• Browser events contain sanitized context only.
• Source maps are uploaded as Sentry artifacts and are not publicly served by the app.