fix(analytics): migrate to native GA4 gtag.js, drop dead UA tag (#855)

[jonfroehlich]

Summary

Production was firing native GA4 (G-M18PCH55ZP) only indirectly. The inline Universal Analytics snippet loaded analytics.js, which chain-loaded the GA4 gtag via a console-side "connected site tag" (visible in DevTools as gtag/js?id=G-M18PCH55ZP&…&_slc=1, initiated from analytics.js):

makeabilitylab.cs.washington.edu/        ← inline UA snippet
  └─ google-analytics.com/analytics.js    ← retired UA library
      └─ googletagmanager.com/gtag/js?id=G-M18PCH55ZP&…&_slc=1   ← chained GA4
          └─ google-analytics.com/g/collect?v=2&tid=G-M18PCH55ZP&…en=page_view

That bridge rides on the retired UA library plus a linkage that lives only in the GA admin console, not in the repo — so GA4 would silently stop collecting if the legacy machinery is removed (or if someone deletes the obviously-dead UA snippet). This is the code side of #855, which originally "shipped GA4" purely via the console with no code change.

Change

• website/templates/website/base.html — replace the UA analytics.js / UA-79723676-1 snippet with the official native gtag.js snippet for G-M18PCH55ZP. GA4 now loads directly, version-controlled, with no dependency on the deprecated UA path. Keeps the {% if debug %} gate (prod-only).
• makeabilitylab/settings.py — bump 2.16.1 → 2.16.2.

No double-counting: removing the UA snippet kills the chain trigger, so only the direct gtag fires.

Verification

• Not visible on -test/local (GA4 is gated off when DEBUG=True — expected).
• After prod deploy (SemVer tag): DevTools → Network → filter G-M18PCH55ZP → the gtag/js request's Initiator should be (index) directly, not analytics.js. GA4 Realtime should still show traffic.

Follow-up (not in this PR)

• Once confirmed on prod, optionally delete the now-inert "connected site tag" in the GA console and retire the old UA property (tidiness only).

🤖 Generated with Claude Code