Abuse controls: send proper events and logs to PostHog

Problem

The hosted abuse controls (#75) send little useful data to PostHog, so operators can't see how they behave.

abuse_flag_raised arrives without its details. It's sent with kind and severity, but PROPERTY_ALLOWLIST (apps/api/src/observability/instance.ts) drops both, so the event only says "a flag, for some team".
Refused signups send nothing. Disposable domain, free-mailbox block and per-IP cap produce no log and no event.
Team pauses, organization suspensions and operator decisions (release, confirm, suspend-org, unsuspend-org) are only in organization_audit_events.
Content scans have no telemetry: nothing on how many emails are checked, passed, held or blocked, or by heuristics or AI.
Pacing deferrals of new accounts' marketing sends aren't recorded.
A failure in recordSignup and a failed operator alert email are only log lines, not PostHog exceptions.
form_id is dropped from the signup-form errors added in Signup forms: block double opt-in without a sender, and show an error when the confirmation can't be sent #102.

Allow these property names through: kind, severity, verdict, reason, outcome, scan_mode, form_id. None of them carries personal data. Email addresses and IPs stay out.
Events, all from abuse.* sources:
- signup_blocked with reason (disposable_email, free_email, too_many_signups)
- content_scanned with verdict and scan_mode (heuristic or ai), sent when a scan actually runs
- team_paused_for_review with reason
- abuse_flag_raised with kind and severity (now kept)
- abuse_flag_resolved with kind and outcome (released or confirmed)
- organization_sending_suspended and organization_sending_unsuspended
- marketing_send_paced, when a new account's send is deferred
A warning-level log line next to each of these, so PostHog Logs shows the same thing.
recordSignup failures and failed operator alert emails go through captureError.

Each event above reaches PostHog with its properties (checked in a real project).
Unit tests cover the events and the allowlist.
Self-hosted installs without POSTHOG_API_KEY behave as before.