fix(#701): disable telemetry by default for self-hosted (OIDC) instances

[rbalogic]

This PR updates the default settings for data collection to be opt-in rather than opt-out for self-hosted/enterprise environments.

Changes:

• Centralized Logic: Introduced getDefaultDataCollectionValue in src/defaults/settings.ts to manage the default-value logic.
• Improved Implementation: Refactored to use the existing isOidcMode() utility from @/lib/auth-mode, ensuring consistency and preventing logic drift.
• Cleaned up Call Sites: Removed manual import.meta.env passing when calling the helper in settings.ts, posthog.tsx, and preferences.tsx.
• Tests: Added and updated unit tests in src/defaults/settings.test.ts to verify the logic across different modes using mocked module behavior.

Validation:

• Verified that data_collection defaults to false when isOidcMode() is true.
• Verified that data_collection defaults to true for consumer mode.
• All tests passed via bun test.

Closes #701

---

Note

Low Risk
Low risk change that only flips the default for the data_collection setting; primary impact is reduced/absent analytics unless a user explicitly opts in.

Overview
Telemetry is now opt-in by default. The default data_collection setting value is changed to false, and both PostHog initialization (getSettings fallback) and the Preferences settings page (useSettings defaults) are updated to assume telemetry is disabled unless explicitly enabled.

^{Reviewed by Cursor Bugbot for commit 71aca1d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit a761452. Configure here.}

[cjroth]

Hey @rbalogic thanks so much for this PR! Really appreciate the contribution.

I'd love to see this get merged if you want to make a few adjustments:

• We can actually go ahead and disable telemetry by default fully (eg just make it false instead of dependent on OIDC mode). The reasoning here is that OIDC is one auth method, but isn't necessarily what I would use as the determining factor for whether a deployment is self-hosted or not.
• Since we're defaulting to not enabled, we can simply use the presence of a posthog api key in the backend env vars as the determining factor. If there's no env key provided, we simply don't pass anything to the frontend, and the frontend simply shouldn't enable it.
• The other thing is that I'd say we can probably remove the tests - or if any tests do make sense, we can find a way to use dependency injection instead of mocking.

[rbalogic]

@cjroth Thanks for the feedback! 🙌

I’ve implemented the requested changes:

• Telemetry is now disabled by default unconditionally (no longer tied to OIDC mode). The frontend default for data_collection is now simply false.
• Kept the frontend behavior aligned with the existing flow: if the backend does not provide a usable PostHog API key, PostHog won’t initialize on the client.
• Removed the mock-based tests that covered the OIDC-dependent defaulting logic, since that logic is no longer needed.

Please take another look when you have a moment—happy to iterate further or make any additional tweaks before merge. Thanks again for the guidance!

[rbalogic]

@cjroth Please review the changes when you can, Thanks.