feat: telemetry relay (Azure Function) for secret-free install metrics

[Ritvik Jayaswal (Ritvik-Jayaswal)]

What

Adds telemetry-relay/ — a Consumption-plan Azure Function that forwards anonymous, opt-in install events from the kit installers to Application Insights, so the App Insights connection string never ships in the repo or the client.

 ships a URL           holds the connection string
                       in app settings (server-side)
```n
## Why
An open-source client can't safely embed an ingestion credential — anything in the package is extractable. The relay keeps the secret server-side (Function app settings, set by Bicep), which resolves the exposed-key concern from #30.

## Contents
- `src/functions/collect.js` — HTTP relay: allow-lists event/property names, caps body size, per-IP rate limit, always returns 202 so telemetry never breaks an install
- `main.bicep` — deploys Log Analytics + App Insights + Function App + storage; wires the connection string into app settings automatically
- `README.md` — deploy steps + a Grafana KQL query for per-skill install counts
- `package.json` / `host.json` / `local.settings.json.sample` / `.gitignore`

## Security
- **No secret in the repo.** Connection string is only in Function app settings.
- `local.settings.json` and `node_modules/` are git-ignored.
- The storage `AccountKey` in Bicep is a deploy-time `listKeys()` expression, not a literal.

## Not included (follow-ups)
- Wiring the installers to POST to the relay URL (`DDBKIT_RELAY_URL`).
- Per-skill *success rate* would require the MCP server to emit outcome events.