fix: send pageviews to the analytics API correctly

- Use the correct endpoint (analytics.mattitja.se instead of the
  non-existent .cloud domain)
- Authenticate with the site ingest secret as a Bearer token so the API
  trusts the forwarded visitor IP and user agent
- Forward the visitor Accept-Language header (required by bot detection)
- Only track successful GET requests rendering HTML
- Short timeouts and a file-based circuit breaker that pauses sending
  after connection failures or 5xx responses, so no queue, worker or
  cache is needed and a down API never slows the host site
- Log rejected requests instead of failing silently

README.md

@@ -16,13 +16,16 @@ Publish the configuration file (optional):
 php artisan vendor:publish --tag=mattitja-analytics-config
 ```
 
-Add your site key to your `.env` file:
+Add your site key and ingest secret to your `.env` file:
 
 ```env
 MATTITJA_ANALYTICS_SITE_KEY=your-site-key
+MATTITJA_ANALYTICS_INGEST_SECRET=your-ingest-secret
 MATTITJA_ANALYTICS_ENABLED=true
 ```
 
+Both values are found under **Site → Install** in Mattitja Analytics. Click "Generate secret" to create the ingest secret. Without it the API ignores the forwarded visitor IP and user agent and rejects the request, so nothing is tracked.
+
 ## Usage
 
 The package automatically registers middleware for the `web` group and starts collecting analytics data immediately after installation and configuration.
@@ -42,6 +45,10 @@ Route::middleware(['mattitja-analytics'])->group(function () {
 
 ### Basic Settings
 - `MATTITJA_ANALYTICS_SITE_KEY` - Your site key from Mattitja Analytics (required)
+- `MATTITJA_ANALYTICS_INGEST_SECRET` - Your site's ingest secret, sent as a Bearer token (required)
+- `MATTITJA_ANALYTICS_TIMEOUT` - HTTP timeout in seconds (default: 1)
+- `MATTITJA_ANALYTICS_CONNECT_TIMEOUT` - Connect timeout in seconds (default: 0.5)
+- `MATTITJA_ANALYTICS_PAUSE_ON_FAILURE` - Seconds to stop sending after the API is unreachable or returns 5xx (default: 60, `0` disables)
 - `MATTITJA_ANALYTICS_ENABLED` - Enable/disable tracking (default: true)
 - `MATTITJA_ANALYTICS_BOTS` - Track bots (default: false)
 
@@ -53,7 +60,7 @@ You can configure paths and IP addresses to ignore in the config file.
 
 ## Data Sent
 
-The package sends the following data to `https://analytics.mattitja.cloud/api/send`:
+The package sends the following data to `https://analytics.mattitja.se/api/send`:
 
 - `k` - Site key
 - `u` - Full URL of the visited page
@@ -61,10 +68,15 @@ The package sends the following data to `https://analytics.mattitja.cloud/api/se
 - `ip` - Visitor's complete IP address
 - `ua` - User agent string
 
+The request is authenticated with `Authorization: Bearer <ingest secret>`, and the visitor's `Accept-Language` header is forwarded.
+
+Only successful `GET` requests that render HTML count as pageviews. Form posts, redirects, JSON responses and requests that expect JSON are skipped.
 ## Security
 
-- Data is sent synchronously directly from middleware
+- Data is sent from the middleware's `terminate()` step, after the response has been sent to the browser
 - IP addresses are NOT anonymized (needed for geolocation)
+- No queue, worker or cache is required. If the API is down, sending pauses for `pause_on_failure` seconds, tracked with a marker file in `storage/framework`, so visitors and PHP workers are never held up
+- All errors are caught and logged, so the API being down never breaks your site
 - Bot traffic is filtered out by default
 - Do Not Track header is respected by default