fix(analytics): Prefix Tool requests /analytics/hash-sizes&region=… (missing '?'), gets HTML instead of JSON #179

Summary

The Prefix Tool's Network Overview builds a malformed URL for /analytics/hash-sizes whenever a region or area filter is active. The server answers with the SPA HTML (200 text/html), not JSON. .catch(() => null) cannot see this: the response is a 200, so it surfaces later as a failed JSON read and the tool falls back silently. The configured-hash-size counts (Kpa-clawbot#1270) are then missing, or wrong, exactly when a region is selected.

Found by the review of PR #175. It is pre-existing and not caused by that PR.

Where (master 84c637ea)

public/analytics.js ~3661–3673, renderPrefixTool():

const rq = RegionFilter.regionQueryString() + AreaFilter.areaQueryString();
…
api('/analytics/hash-sizes' + rq, { ttl: CLIENT_TTL.analyticsRF }).catch(() => null),

regionQueryString() returns '&region=…' (public/region-filter.js ~64), so the path becomes /analytics/hash-sizes&region=SJC with no ?. In the same call, fetchAllNodes('&sortBy=lastSeen' + rq, …) is correct, because that helper adds its own ?… prefix.

This was introduced with upstream #1270/#1271 (46ce9590, 2026-05-18), and the same line exists in upstream master.

Evidence (staging, 2026-10-03)

GET /api/analytics/hash-sizes&region=SJC   → 200 text/html; charset=utf-8
GET /api/analytics/hash-sizes?region=SJC   → 200 application/json

Fix

• Build the query correctly. For example, '/analytics/hash-sizes' + (rq ? '?' + rq.slice(1) : ''), or a small shared helper that turns &a=…&b=… into ?a=…&b=….
• Check the other api('/analytics/…' + <something starting with '&'>) call sites for the same pattern. The Hash Stats tab uses sepBase (~327) and looks correct, but verify it.
• Consider having api() treat a non-JSON 200 (Content-Type not JSON) as an error, so this class of bug fails loudly. If that turns out to be broad, make it a separate change.

Tests

• Unit (vm harness): with a region and an area active, renderPrefixTool requests /api/analytics/hash-sizes?region=…&area=…; with neither active, it requests /api/analytics/hash-sizes.
• Mutant: reverting to '/analytics/hash-sizes' + rq turns the test red.
• E2E (optional): with a region selected, the Network Overview shows the configured-hash-size counts from the JSON.

Do not touch public/analytics.js while #175 (which also edits it) is open. Start from master after #175 is merged, or coordinate.

Relates to #175.