SCRUM-196: GA4 analytics config for fulfillr Traffic & funnel tab

Render an analytics block (property 353859448 + service-account key) into the
fulfillr dev and prod configs once fulfillr_ga4_credentials is in the vault.
Without the vault var the block is omitted and the portal reports GA as not
connected. Remember to restart the container after deploy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ansible/roles/podman/defaults/main.yml

@@ -326,3 +326,6 @@ cifs_watchdog_mounts:
   - "{{ photos_path }}/storage"
   - "{{ photos_path }}/immich"
 
+# GA4 property for the fulfillr portal Traffic & funnel tab (SCRUM-196, non-secret).
+# Shared by dev and prod. The service-account key `fulfillr_ga4_credentials` lives in the vault.
+fulfillr_ga4_property_id: "353859448"

ansible/roles/podman/templates/fulfillr/dev.json.j2

@@ -53,5 +53,13 @@
   "recovery": {
     "schedule_name": "cart-recovery-dev",
     "schedule_group": "default"
+  }{%- if fulfillr_ga4_credentials is defined %},
+  {# GA4 Data API for the portal Traffic & funnel tab (SCRUM-196). Renders only once the
+     service-account key `fulfillr_ga4_credentials` (the key JSON, as a mapping or string)
+     is in the vault; without it the traffic endpoint reports configured:false. #}
+  "analytics": {
+    "ga4_property_id": "{{ fulfillr_ga4_property_id }}",
+    "ga4_credentials": {{ (fulfillr_ga4_credentials if fulfillr_ga4_credentials is mapping else (fulfillr_ga4_credentials | from_json)) | to_json }}
   }
+{%- endif %}
 }

ansible/roles/podman/templates/fulfillr/production.json.j2

@@ -53,5 +53,13 @@
   "recovery": {
     "schedule_name": "cart-recovery-prod",
     "schedule_group": "default"
+  }{%- if fulfillr_ga4_credentials is defined %},
+  {# GA4 Data API for the portal Traffic & funnel tab (SCRUM-196). Renders only once the
+     service-account key `fulfillr_ga4_credentials` (the key JSON, as a mapping or string)
+     is in the vault; without it the traffic endpoint reports configured:false. #}
+  "analytics": {
+    "ga4_property_id": "{{ fulfillr_ga4_property_id }}",
+    "ga4_credentials": {{ (fulfillr_ga4_credentials if fulfillr_ga4_credentials is mapping else (fulfillr_ga4_credentials | from_json)) | to_json }}
   }
+{%- endif %}
 }