feat(observability): one stable user id — Sentry now knows who the caller is

[BSalaeddin]

Why

$ grep -rn 'setUser' apps/caramel-app/src
(no output)

PostHog identifies on users.id (identity.ts:112) and Sentry was handed that id only as a
free-text context blob (posthog_distinct_id inside setContext('posthog', …)). Sentry does
nothing with context: "users affected" counts, user.id:<id> search and issue-to-account
attribution all read the user field, which nothing ever set. So every Caramel issue was
structurally anonymous — you could see that a route threw, never for whom.

Found during the /paid-user-watch fleet run (2026-09-16), whose whole premise is that you must be
able to read one user's story across systems before you judge them.

What changes

The id is set in the one place each side learns the identity — not sprinkled at call sites.

Browser — PostHogClientProvider, on every session transition. Deliberately moved above the
activeRef guard: Sentry and PostHog are separately configured, and a deploy without a PostHog key
must still produce attributable Sentry issues. (That guard is exactly why the old code had no
identity call on this path at all.) setSentryUser(null) on logout, so the next anonymous visitor
on a shared device does not keep reporting as the account that just left.

Server — withRoute, immediately after auth.api.getSession. That single line covers every
route that declares auth, present and future, and clears the field for an anonymous
auth: 'optional' request so a reused server context cannot leak the previous caller's identity
onto someone else's error.

ID only. The same users.id in Sentry, PostHog and Postgres — one join key across all three.
No email, no name; sendDefaultPii stays off.

Tests

tests/unit/stable-user-id.test.ts — 4 cases: the payload is {id} and nothing else, logout clears
it, an authenticated withRoute request is attributed to the DB user id, and an anonymous
auth: 'optional' request clears it.

tests/unit/withRoute.test.ts's @sentry/nextjs mock gains setUser (it previously exported only
captureException, so the auth tests faulted on the missing export).

Local gates: tsc --noEmit clean · prettier --check clean · full app unit suite green, 79 files
/ 723 tests.

🤖 Generated with Claude Code