Add Google Tag Manager

[n-lark]

Install Google Tag Manager (GTM-55L36797)

Marketing wants Google Tag Manager (container GTM-55L36797) on the free-trial signup page (/account/create).

Can't be a raw paste. We're a SPA — frontend/src/index.html is one shell for all routes and all deployments — so it needs to follow how we already wire GA/HubSpot:

• Config-driven — add a GTM option to flowforge.yml telemetry so it only loads where enabled (self-hosted installs haven't opted into Google).
• Consent-gated — inject via injectAnalytics (forge/routes/ui/index.js), mirroring the _ffLoadGoogleAnalytics block, and fire it from the cookie-consent store on accept. GTM's default snippet loads without a consent check; ours can't.

Ship only the <script> half below — skip the <noscript> iframe (can't be consent-gated, and GTM needs JS to do anything anyway).

<!-- Google Tag Manager -->
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-55L36797');</script>
<!-- End Google Tag Manager -->

Also needed

• Helm chart — reach out to Ben or Piotr to expose the new GTM config so it flows into flowforge.yml on Helm-deployed installs.
• Product docs — update the Telemetry configuration table in docs/install/configuration.md (~line 159) with the new option. Note: the existing telemetry.frontend.google.tag row is labeled "Google Tag Manager ID" but actually drives Google Analytics (gtag/js), not a GTM container — the new option needs its own row to avoid conflating the two.

[n-lark]

Hey @knolleary will you look this over and lmk if I am missing anything thanks!

Update: Talked with nick and updated the above issue with the info needed around docs and helm chart updates.

[n-lark]

Test plan

Set telemetry.frontend.google.gtm: GTM-55L36797 in flowforge.local.yml, then:

• On page load, before consent: gtm.js does not request in the Network tab, and the cookie banner shows.
• Banner appears when GTM is the only tracker configured (no posthog/GA/hubspot).
• After clicking accept: gtm.js?id=GTM-55L36797 loads and window.dataLayer contains the gtm.start entry.
• After rejecting: gtm.js never loads.
• Reload with consent already accepted: loads once, no double-load (the _ffGoogleTagManagerLoaded guard holds).
• With no google.gtm set: no GTM script injected, no _ffLoadGoogleTagManager on window.