What

Crash reports currently die in the overlay: we ask users to screenshot or copy the error text, and almost nobody follows through. This adds a first-party collection pipeline, entirely on our existing Cloudflare account:

• workers/crash-report/ — a Worker on crash.reasonix.io (orange-cloud, so it is reachable from CN like the rest of our infra). D1-backed, fingerprint-deduped (stack normalized for paths/line numbers/addresses, max 5 raw samples kept per group), per-IP rate limited (5/min), 32 KB body cap, zod-validated. The endpoint is public by necessity (the client is open source), so it is designed to hold nothing secret and accept abuse gracefully.
• desktop/crash_app.go — a ReportCrash binding that scrubs user names out of Windows/macOS/Linux home paths, attaches the injected build version plus GOOS/GOARCH, and POSTs through the same proxy-aware httpClient() the updater uses.
• Crash overlay — gains a "Send report" button next to Copy, with a one-line privacy note stating exactly what the report contains. Reports are sent only on that click; there is no automatic or background telemetry of any kind. The button only renders when the Wails binding exists (hidden in browser dev).

Privacy stance

• Nothing is sent without an explicit user click, every time.
• Payload is the visible error text (user names already scrubbed) + version + OS + arch. No prompts, no keys, no machine identifiers.

Deploy (one-time, before merge is user-visible)

cd workers/crash-report
npx wrangler d1 create reasonix-crash    # paste database_id into wrangler.toml
npx wrangler d1 execute reasonix-crash --remote --file=schema.sql
npx wrangler deploy

Until the Worker is live, a clicked send fails gracefully ("Send failed — use Copy instead").

Verification

• go vet + new unit tests pass (scrubUserPaths cases, POST round-trip against httptest, input rejection); new files are gofmt-clean.
• Frontend tsc --noEmit introduces zero new errors vs the pristine-checkout baseline (the wailsjs module errors are the known local-only artifact).
• Worker package typechecks clean.

Follow-ups (not in this PR)

• Go-side panic capture (write crash file on panic, offer to send on next launch).
• Optional: Worker auto-files a GitHub issue on first sight of a new fingerprint (token stays server-side).
• CI job for workers/ typecheck.