add goatcounter tracking to all sites via nginx sub_filter

USECASES.md

@@ -102,7 +102,17 @@ for stateless static sites.
 - SSL cert issued for `<name>.hantim.net` (no www variant)
 - Service ready for customization (edit compose.yml image, add `.env.keys` if needed)
 
-## 9. Upload media files
+## 9. Analytics tracking
+
+**Trigger:** automatic — nginx injects the GoatCounter script into all HTML responses.
+
+**Expected outcome:**
+- Every site includes the GoatCounter tracking script (injected via `sub_filter`)
+- Page views are recorded at `goatcounter.hantim.net`
+- New sites provisioned with `app.sh` include tracking automatically
+- GoatCounter dashboard itself is not tracked
+
+## 10. Upload media files
 
 **Trigger:** `aws s3 cp` or `aws s3 sync` to `s3://example.com/`, or `./media.sh push` from a site repo.
 
@@ -111,7 +121,7 @@ for stateless static sites.
 - Replicated to both Garage nodes (hantim + argento)
 - Accessible at `https://www.example.com/media/<path>`
 
-## 10. Local development with media files
+## 11. Local development with media files
 
 **Trigger:** `./media.sh pull` from a site repo.