start: private new-tab dashboard at /start (tasks, notifications, backups/timers, server + containers, service status, trackers, editable links, / search)

- home schema: home.links (seeded, owner-editable) and home.snapshots (written by a host collector)
- deploy/home-collector: stdlib Python + systemd user timer (60s) that snapshots /proc stats,
  docker containers, systemd timers, service HTTP checks and ntfy topics via a limited role
- extras/newtab-extension: MV3 new-tab override, zipped to static/newtab-extension.zip
- owner-only pages skip Google Analytics; /trackers/health#body anchor for weigh-ins

src/hooks.server.ts

@@ -4,6 +4,8 @@ import { auth } from '#lib/server/auth.js';
 import { isOwner, isOwnerOnlyPath, isOwnerWritePath } from '#lib/server/owner.js';
 import { error } from '@sveltejs/kit';
 
+const analytics = /<!-- analytics -->[\s\S]*?<!-- \/analytics -->/;
+
 export const handle: Handle = async ({ event, resolve }) => {
 	// Match the endpoint path here: the dev proxy may terminate HTTPS before Vite.
 	// Better Auth validates request origins against its configured public URL.
@@ -21,7 +23,12 @@ export const handle: Handle = async ({ event, resolve }) => {
 	const read = event.request.method === 'GET' || event.request.method === 'HEAD';
 	if (!owner && ((ownerOnly && !read) || (!read && isOwnerWritePath(event.url.pathname))))
 		error(404, 'Not Found');
-	const response = await resolve(event);
+	// Private pages (the /start new-tab dashboard, trackers) skip Google Analytics: less to
+	// load, and nothing private gets reported.
+	const response = await resolve(
+		event,
+		ownerOnly ? { transformPageChunk: ({ html }) => html.replace(analytics, '') } : undefined
+	);
 	if (ownerOnly) {
 		response.headers.set('x-robots-tag', 'noindex, nofollow, noarchive');
 		response.headers.set('cache-control', 'private, no-store');