README says "No Telemetry" but analytics are enabled by default without consent #481

Hi, thanks for opcode.

The README's security section says "Local Storage: All data stays on your machine" and "No Telemetry: No data collection or tracking" (README.md:383-384). At commit d1ca30a the app ships PostHog analytics that are on by default:

• posthog-js is initialised with a project key and https://us.i.posthog.com (src/lib/analytics/index.ts:30-31), before the first render (src/main.tsx).
• When nothing is stored yet, the consent defaults are enabled: true, hasConsented: true (src/lib/analytics/consent.ts:25-29), so events are sent without the user opting in.
• The consent dialog components exist but are not rendered anywhere; the only way to stop it is a toggle in Settings.

Either the README or the default should change. Suggested fix: default to enabled: false, hasConsented: false, show the existing consent dialog on first launch, and update the README to describe what is collected.

Found while testing Elliot, a tool I'm building that checks docs against code.