feat(crash-reporting): opt-in crash reporting behind a build-time SENTRY_DSN gate

[TaprootFreak]

Problem

Two customer cases this week reached support with zero diagnostic evidence: a BitBox02 USB connect crash/hang on Android and a registration-signing blocker (both 23.07.). Server-side request tracing covers everything that reaches the API — but a client-side crash before any request is invisible. The app has no crash reporter; every error thrown from a Future, Stream or Timer callback vanishes without trace (#866 documents this gap explicitly, and installErrorHandlers() was designed as the hook a reporter plugs into).

Change

• sentry_flutter behind a compile-time gate. initCrashReporting() (new, lib/setup/error_handling/crash_reporting.dart) reads --dart-define=SENTRY_DSN. Without an injected DSN — i.e. in every local, test and current CI build — the SDK never starts and produces no network traffic. The app behaves exactly as before this PR.
• Best-effort by contract: a malformed DSN or a failing native binding is logged and swallowed inside initCrashReporting() — reporting infrastructure can never keep the wallet from starting. Covered by a dedicated test.
• Wiring order is load-bearing: main() calls initCrashReporting() after installErrorHandlers(), because installErrorHandlers() overwrites PlatformDispatcher.onError without chaining — the reverse order would silently drop the SDK's async-error hook. The SDK itself chains both handlers it wraps (FlutterError.onError: capture, then delegate; PlatformDispatcher.onError: delegate, then capture). In release mode the native splash is now preserved before this first await, so the added async gap cannot flash the splash to blank.
• Pinned option surface — the guarantee is exactly this list: sendDefaultPii=false, attachScreenshot=false, enableAutoSessionTracking=false, tracesSampleRate=null — error events only, no session telemetry. Native crash handling and ANR detection deliberately stay on their SDK defaults: they produce precisely the error events this reporter exists for. View-hierarchy attachment stays off by SDK default; its option is experimental and deliberately not referenced. Environment defaults to production, overridable via --dart-define=SENTRY_ENVIRONMENT.
• CONTRIBUTING § API Access: adds the one scoped exception for first-party crash reporting, and declares any widening of the reported data (breadcrumbs with request URLs, user context, attachments) a review-blocking change.

Tests

• test/setup/error_handling/crash_reporting_test.dart: DSN gate (no-op without DSN, exactly one init with DSN), the full pinned option set, and the swallow-on-failure contract, via the injectable CrashReporterInit — no platform channels involved.
• // @no-integration-test annotation on initCrashReporting per CONTRIBUTING: the native SDK only starts in builds that inject a DSN, which no test build does.

Open points before this becomes effective

1. Release pipeline: the release workflow must inject SENTRY_DSN (repo/environment secret + --dart-define) — deliberately a separate PR, so this one stays inert and fully reviewable on its own.
2. Native release build check: PR CI runs analyze + tests; the first tagged build after the pipeline change should be smoke-checked once (Android Gradle / iOS pods pull in the native SDK parts).
3. Follow-up (separate PR): attach BitBox device context (product, firmware version) and connect-flow breadcrumbs after connect, so hardware-related crashes carry the device facts that today require asking the customer.

[TaprootFreak]

3 review passes until zero findings.

Pass 1 fixes: made the reporter init best-effort (a failing or misconfigured reporter can no longer block app startup — with a dedicated test), moved the release-mode splash preserve ahead of the first await, corrected the handler-chaining description to match the pinned SDK version's actual behavior, additionally pinned session tracking off and narrowed the pinning claim to the exact option list, fixed the test-file import order, and removed an internal record reference from the PR description.

Pass 2 fix: restored installErrorHandlers() as the very first bootstrap step so its documented guarantee holds while still leaving no async gap before the splash preserve.

Pass 3: clean.