fix(frontend): drop exceptions from code injected into the page

[posthog-eu]

Summary

Problem

• Error tracking opened a TypeError issue for a snippet run inside the /apps page (Array.from(document.querySelectorAll('td')).find(...).outerHTML) — that selector exists nowhere in our code.
• A console paste, a browser extension, or an AI browser agent walking the DOM looks exactly like this: one in-app frame whose file is the page URL, function global code, line 1. Code we ship always runs from a hashed chunk under /assets/.
• Cost is triage, not users (1 event, 1 user, 1 session): every injected snippet that throws mints a fresh issue with a first-seen alert, and someone burns time proving it is not ours.

Changes

• shouldSuppressPostHogExceptionEvent matched message text only and never looked at frames. Added a frame-based rule: drop an $exception whose only in-app frame points at the document URL itself.
• The rule compares each in-app frame filename against $current_url (both with query and hash stripped). A frame that is the page document, not an /assets/ chunk, is injected code.
• This kills the whole class of injected-code exceptions, not just this one message.

Test plan

• bunx vitest run tests/stale-asset-errors.unit.test.ts — new cases cover the console-paste TypeError (dropped), a genuine bundled-asset error on the same page (kept), and the empty / missing-URL / non-in-app edge cases.

Screenshots

Checklist

• My code follows the code style of this project and passes
  bun run lint:backend && bun run lint.
• My change requires a change to the documentation.
• I have updated the documentation
  accordingly.
• My change has adequate E2E test coverage.
• I have tested my code manually, and I have provided steps how to reproduce
  my tests

---

Created with PostHog Desktop from this inbox report.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing posthog-self-driving/fixfrontend-drop-exceptions-from-code-3a4ed5 (6cb24ae) with main (225fedb)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud