fix(telemetry): review findings

- wau/mau trailing scans run hourly and on day finalization, not every tick
- exclusion lookup failures cached 30s so an st outage cannot amplify
- unverified relation filter dropped; player emptiness checked in js
- anonymous unauthenticated read failures no longer logged
- alerts and exclusions ensure supertokens init on cold pods

src/utils/activities.test.ts

@@ -308,6 +308,42 @@ describe("serverFnLoggingMiddleware control flow and dedup", () => {
     expect(h.createActivity.mock.calls[0][0].error).toContain("FORBIDDEN");
   });
 
+  it("does not record anonymous Unauthenticated failures", async () => {
+    setRequest("http://localhost:3000/_serverFn/x");
+
+    await expect(
+      runMiddleware({
+        next: async () => {
+          throw new Error("Unauthenticated");
+        },
+        data: undefined,
+        context: {},
+        serverFnMeta: { id: "x", name: "fetchMe" },
+      })
+    ).rejects.toThrow("Unauthenticated");
+
+    await flushWrites();
+    expect(h.createActivity).not.toHaveBeenCalled();
+  });
+
+  it("still records Unauthenticated failures for identified actors", async () => {
+    setRequest("http://localhost:3000/_serverFn/x");
+    setRequestActor(h.request as unknown as Request, { playerId: "p1" });
+
+    await expect(
+      runMiddleware({
+        next: async () => {
+          throw new Error("Unauthenticated");
+        },
+        data: undefined,
+        context: {},
+        serverFnMeta: { id: "x", name: "fetchMe" },
+      })
+    ).rejects.toThrow("Unauthenticated");
+
+    await vi.waitFor(() => expect(h.createActivity).toHaveBeenCalledTimes(1));
+  });
+
   it("does not record activity for excluded players", async () => {
     setRequest("http://localhost:3000/_serverFn/doThing");
     setRequestActor(h.request as unknown as Request, { playerId: "excluded-player" });