docs(www): update feature documentation for v2.16.0

Updated pages: plugins/analytics (Event Tracking API), security (CSRF improvements, BruteForceDetector resilience)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: lane711

www/src/app/plugins/analytics/page.mdx

@@ -5,6 +5,7 @@ export const sections = [
   { title: 'Tracking Page Views', id: 'tracking-page-views' },
   { title: 'Custom Events', id: 'custom-events' },
   { title: 'API Reference', id: 'api-reference' },
+  { title: 'Event Tracking API', id: 'event-tracking-api' },
   { title: 'Analytics Service', id: 'analytics-service' },
   { title: 'Admin Dashboard', id: 'admin-dashboard' },
   { title: 'Configuration', id: 'configuration' },
@@ -393,6 +394,125 @@ All analytics endpoints require authentication with `admin` or `analytics:read`
   </Col>
 </Row>
 
+### Event Tracking API <span className="px-2 py-0.5 text-xs font-bold bg-emerald-100 dark:bg-emerald-900/30 text-emerald-700 dark:text-emerald-300 rounded">NEW in v2.16.0</span>
+
+The `/api/events` endpoint provides a public HTTP API for tracking events from client-side code, external services, or any HTTP client. No authentication required for tracking; admin auth required for querying.
+
+<Row>
+  <Col>
+    **Track a single event:**
+
+    **Request Body:**
+    - `event` (required) - Event name
+    - `category` - Event category (default: `general`)
+    - `data` - Additional metadata object
+    - `path` - Page URL path
+    - `session_id` - Session identifier
+    - `user_id` - User identifier
+  </Col>
+  <Col>
+    <CodeGroup title="Track Single Event">
+
+    ```bash
+    curl -X POST 'https://your-app.workers.dev/api/events' \
+      -H 'Content-Type: application/json' \
+      -d '{
+        "event": "button_click",
+        "category": "ui",
+        "data": { "button": "signup", "variant": "hero" },
+        "path": "/pricing"
+      }'
+    ```
+
+    </CodeGroup>
+
+    <CodeGroup title="Response">
+
+    ```json
+    {
+      "success": true,
+      "id": "evt_abc123"
+    }
+    ```
+
+    </CodeGroup>
+  </Col>
+</Row>
+
+<Row>
+  <Col>
+    **Track batch events (up to 100):**
+
+    Send an array of events in a single request for better performance.
+  </Col>
+  <Col>
+    <CodeGroup title="Batch Track">
+
+    ```bash
+    curl -X POST 'https://your-app.workers.dev/api/events' \
+      -H 'Content-Type: application/json' \
+      -d '[
+        { "event": "page_view", "path": "/home" },
+        { "event": "page_view", "path": "/about" },
+        { "event": "click", "category": "nav", "data": { "target": "pricing" } }
+      ]'
+    ```
+
+    </CodeGroup>
+
+    <CodeGroup title="Response">
+
+    ```json
+    {
+      "success": true,
+      "count": 3
+    }
+    ```
+
+    </CodeGroup>
+  </Col>
+</Row>
+
+<Row>
+  <Col>
+    **Query events** (admin auth required):
+
+    **Query Parameters:**
+    - `event` - Filter by event name
+    - `category` - Filter by category
+    - `limit` - Max results (default: 100)
+    - `offset` - Pagination offset
+  </Col>
+  <Col>
+    <CodeGroup title="Query Events">
+
+    ```bash
+    curl -X GET 'https://your-app.workers.dev/api/events?category=ui&limit=50' \
+      -H 'Authorization: Bearer YOUR_TOKEN'
+    ```
+
+    </CodeGroup>
+  </Col>
+</Row>
+
+<Row>
+  <Col>
+    **Get event stats** (admin auth required):
+
+    Returns aggregated counts grouped by event name.
+  </Col>
+  <Col>
+    <CodeGroup title="Event Stats">
+
+    ```bash
+    curl -X GET 'https://your-app.workers.dev/api/events/stats' \
+      -H 'Authorization: Bearer YOUR_TOKEN'
+    ```
+
+    </CodeGroup>
+  </Col>
+</Row>
+
 ---
 
 ## Analytics Service

www/src/app/security/page.mdx

@@ -47,7 +47,8 @@ SonicJS enforces role-based permissions across all routes:
 ### CSRF Protection
 - Signed double-submit cookie pattern on all state-changing endpoints
 - Automatic token generation and validation
-- Exempt: public read-only API endpoints
+- Exempt: safe methods (GET, HEAD, OPTIONS), auth routes, public form submissions, event tracking API, Stripe webhooks, and search API
+- Requests with `Authorization` header (Bearer token or API key) bypass CSRF — CSRF only applies to cookie-authenticated sessions
 
 ### CORS Configuration
 - Cross-origin requests restricted to explicitly allowed origins via `CORS_ORIGINS` environment variable
@@ -106,7 +107,7 @@ SonicJS includes a built-in **Security Audit Plugin** that provides security eve
 
 ### How Lockouts Work
 
-When brute-force detection is enabled, the plugin uses Cloudflare KV for fast lockout state:
+When brute-force detection is enabled, the plugin uses Cloudflare KV for fast lockout state. If the `CACHE_KV` binding is not available, the brute-force detector gracefully degrades — all KV-dependent methods return safe defaults instead of crashing:
 
 1. Each failed login increments counters for the IP and email address
 2. When an IP exceeds the threshold, it is locked and receives `429 Too Many Requests` on subsequent login attempts
@@ -139,6 +140,7 @@ All security audit data is available via authenticated admin API endpoints:
 
 | Version | Date | Changes |
 |---------|------|---------|
+| v2.16.0 | Apr 2026 | BruteForceDetector KV resilience, CSRF exempt path expansion, Authorization header bypass for API clients |
 | v2.9.0 | Apr 2026 | RBAC enforcement on all admin routes |
 | v2.8.3 | Mar 2026 | SQL injection fix, XSS fixes (reflected + stored), PBKDF2 hashing, CSRF protection, rate limiting, CORS restrictions, security headers, JWT secret to env var |
 | v2.8.2 | Mar 2026 | Public form XSS sanitization, content API access restrictions |