frontend: CloudWatch RUM + client error reporting

[jonmatum]

Priority: P1
Parent: #34

Context

The frontend SPA ships with no real-user monitoring and no client-side error reporting. A JS error on the capture page today is invisible.

Requirements

• CloudWatch RUM app monitor provisioned in Terraform (aws_rum_app_monitor) with the CloudFront distribution origin whitelisted
• RUM snippet integrated in frontend/src/main.tsx behind a per-env flag (disabled in dev by default)
• Sample rate: 100 % errors, 20 % page views (tunable)
• Capture custom events for: capture submit success/failure, node chat submit, graph load, auth failures
• Client-side unhandled error + unhandled promise rejection pushed to RUM
• Alarm on error rate > N per 5 min

Non-goals

• Third-party services (Sentry, Datadog) — stay in-AWS for now

Acceptance criteria

• RUM dashboard shows page views and errors from a real session
• Triggering a deliberate client error surfaces in RUM within 2 min
• Deployment remains zero-cost-at-idle (RUM pricing accepted at projected volume)

References

• Production readiness — consolidated plan (tracking) #34 (parent)